+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Artificial Intelligence (https://hackforums.net/forumdisplay.php?fid=460)
+---- Forum: AI Tools, APIs & Platforms (https://hackforums.net/forumdisplay.php?fid=464)
+---- Thread: [Vibe] Lovable's LACK of security starts early (/showthread.php?tid=6323758)
Lovable's LACK of security starts early - Hackers - Apr 13, 2026
Aaaaand I quote:
Quote:That's it — just one line. There are no explicit [functions], [auth], [db], or any other configuration blocks defined. This means all edge functions inherit Lovable Cloud's defaults (which includes verify_jwt = false globally for all functions).
That is Lovable's own description of how its internal Supabase system works. No auth security by default. If you make the same project in Supabase yourself, and deploy the same functions, you will notice that auth is always enabled by default when no other settings are provided to tell it to include the auth check (or not to).
There are a number of reasons to not run a project on Lovable in production, but it's still a great platform for smaller scoped projects, starting things off, etc.
If you use Lovable, ask it to set everything up with a custom Supabase ... do not allow it to create one for you, it's a pain to get off (migrate), and as you can see it's not secure by default.
RE: Lovable's LACK of security starts early - Dystortion - Apr 13, 2026
(Apr 13, 2026 01:29 PM)Hackers Wrote: Aaaaand I quote:
That is Lovable's own description of how its internal Supabase system works. No auth security by default. If you make the same project in Supabase yourself, and deploy the same functions, you will notice that auth is always enabled by default when no other settings are provided to tell it to include the auth check (or not to).
There are a number of reasons to not run a project on Lovable in production, but it's still a great platform for smaller scoped projects, starting things off, etc.
If you use Lovable, ask it to set everything up with a custom Supabase ... do not allow it to create one for you, it's a pain to get off (migrate), and as you can see it's not secure by default.
How does that make anything easier for loveable? ships faster - feels more productive to not tech savvy users? therefore lures them into a false sense of accomplishment?
RE: Lovable's LACK of security starts early - Hackers - Apr 13, 2026
(Apr 13, 2026 03:36 PM)Dystortion Wrote: How does that make anything easier for loveable? ships faster - feels more productive to not tech savvy users? therefore lures them into a false sense of accomplishment?
They need to prioritize security over speed, but vibe coders need to also know the rules and how to check for problems. Certain groups have said over half of vibe coded projects have security problems that would be simple for an attacker to find, but the true exploitability may be lower.
I think any AI platform can have flaws if not prompted. Lovable is more than capable of implemented the proper security rules if you prompt for it, but their platform is also slower than local dev so I won't recommend Lovable for anyone that is willing to use an AI/agent connected IDE instead.
RE: Lovable's LACK of security starts early - CL1B - Apr 14, 2026
"but vibe coders need to also know the rules and how to check for problems"
Nope, that's the real devs job. The average vibecoder and average actual dev are nothing alike when it comes to pragmatic thinking.
Can't wait for that generation to realize they were never fit for it in the first place, 2026 the non tech consumer already can tell slop generated webapps from good ones. Took them 1 year, let that sink in.
Mad quick.
RE: Lovable's LACK of security starts early - Hackers - Apr 14, 2026
(Apr 14, 2026 03:58 AM)MarlboroMan Wrote: "but vibe coders need to also know the rules and how to check for problems"
Nope, that's the real devs job. The average vibecoder and average actual dev are nothing alike when it comes to pragmatic thinking.
Can't wait for that generation to realize they were never fit for it in the first place, 2026 the non tech consumer already can tell slop generated webapps from good ones. Took them 1 year, let that sink in.
Mad quick.
I don't think a dev that is not using AI is a real dev anymore. A vibe coder is not a dev, but a dev who can't vibe code is incompetent.
People are free to disagree, but the world economy and tech industry doesn't give a fuck. My "opinion" on this is factual.
Btw, not disagreeing with you - just making a statement. Vibe coder slop doesn't compare to a real engineer. But a real engineer using AI is far better than an engineer without, at rates of 10x-100x depending on the task, if not more in automated workflows.
But yerp - they will realize, and they already are. The amount of people stressing out is kinda funny. They build out a whole web app, get customers with real contracts, and then have no ability to maintain the system or secure it... It's negligible.
To run a company, especially a SaaS, you need engineering skills, UI/UX, marketing, client meetings, contracting, business logistics, etc. It's not just about making an app, that was always just 1 part of running a company and many vibe coders are blissfully unaware of that.
Dev is just a means to an end, the real liability comes from production deployments.
RE: Lovable's LACK of security starts early - CL1B - Apr 14, 2026
Any dev bachelor level degree will show you its 80% teaching you how to think and 20% teaching you to write code. Even for the AI degrees.
It has always been like this, I had convo few days back where one was mad he doesn't get jobs without a degree. It's for the exact same reason.
So when you say "but vibe coders need to also know the rules and how to check for problems" that just comes off as a bad joke, it's like demanding 10 year olds to do account and filling in tax statements.
RE: Lovable's LACK of security starts early - Hackers - Apr 14, 2026
(Apr 14, 2026 08:35 AM)MarlboroMan Wrote: Any dev bachelor level degree will show you its 80% teaching you how to think and 20% teaching you to write code. Even for the AI degrees.
It has always been like this, I had convo few days back where one was mad he doesn't get jobs without a degree. It's for the exact same reason.
So when you say "but vibe coders need to also know the rules and how to check for problems" that just comes off as a bad joke, it's like demanding 10 year olds to do account and filling in tax statements.
True, I said that statement with the full awareness that most vibe coders will fall flat on their face and not develop the awareness of the problem until it's too late to fix it.
RE: Lovable's LACK of security starts early - sammy0x - May 8, 2026
(Apr 14, 2026 08:08 AM)Hackers Wrote: I don't think a dev that is not using AI is a real dev anymore. A vibe coder is not a dev, but a dev who can't vibe code is incompetent.
People are free to disagree, but the world economy and tech industry doesn't give a fuck. My "opinion" on this is factual.
Btw, not disagreeing with you - just making a statement. Vibe coder slop doesn't compare to a real engineer. But a real engineer using AI is far better than an engineer without, at rates of 10x-100x depending on the task, if not more in automated workflows.
But yerp - they will realize, and they already are. The amount of people stressing out is kinda funny. They build out a whole web app, get customers with real contracts, and then have no ability to maintain the system or secure it... It's negligible.
To run a company, especially a SaaS, you need engineering skills, UI/UX, marketing, client meetings, contracting, business logistics, etc. It's not just about making an app, that was always just 1 part of running a company and many vibe coders are blissfully unaware of that.
Dev is just a means to an end, the real liability comes from production deployments.
I total agree with your thoughts on "to run a company, especially a SaaS, you need engineering skills, UI/UX, marketing, client meetings, contracting, business logistics, etc. It's not just about making an app, that was always just 1 part of running a company and many vibe coders are blissfully unaware of that"
What I want to understand is that for a Non tech entepreneur, all the above skills except engineering, UI/UX can be easily accomplished. Since selling/marketing is a general instint which will come automatically with the years of experience a person has.