That's not the problem here. Lovable uses the Supabase Auth layer; they just have their own interface on top of it.

Supabase is kind of similar to Firebase in that you usually communicate directly with the browser through a JavaScript lib. So you need to pay close attention to the security rules (RLS policy in Supabase's case) to restrict data per row based on the user auth.

It's easy to get it wrong; that's why so many Firebase and Supabase databases end up exposed. The platforms have improved the UX so that it's not so common anymore, but it's definitely a gun that's easy to shoot yourself with.

You don't have to expose it like that. You can disable that client and use a server to communicate with the database, which reduces the exposed surface in exchange for complexity (by even having a backend at all).

Mix that design with users with zero tech background who know nothing about systems design and LLMs, and you have a recipe for disaster.

We use Lovable as a prototyping tool and then eject it, review, and deploy on a different platform. It works great for that use case.