// Decision comparison
Lovable vs Bolt.new: which is more secure?
Quick answer
Neither is secure by default, and they fail in different places. Lovable mostly fails at RLS: it creates a Supabase table with no policy and the frontend anon_key dumps the whole table (that was CVE-2025-48757, 170+ apps). Bolt mostly fails in the client: being frontend-first, it drops paid API keys and sometimes the Supabase service_role into the bundle, which scrapers find in hours.
If the question is "which to pick", the honest answer is: the security difference between them is smaller than the difference your discipline makes. Both need a review before real users. Pick on the product; treat security as a required step in both.
Where each one leaks
The dominant hole changes by tool, and knowing yours directs the review:
| Vector | Lovable | Bolt.new |
|---|---|---|
| Dominant hole | RLS off on Supabase | Key/secret in the client bundle |
| anon_key / service_role | anon_key without RLS dumps tables | service_role sometimes leaks to client |
| Paid API key | Less exposed (more server) | Often in the client (browser→provider) |
| XSS / input | Happens | Common (unescaped input) |
| First review | RLS policy table by table | Key sweep in the bundle |
What to review in each
In a Lovable app, start by testing what the anon_key reaches without login and lock RLS per table. In a Bolt app, start by opening the bundle and hunting for keys and service_role, then move everything to environment variables and a server function. The Promptbook covers both paths; serious signals go to Risk Review.
Frequently asked questions
So which is more secure?
On average, both have a similar hole rate (independent tests point to a 40-45% vulnerability rate in generated apps). What changes is WHERE: Lovable at RLS, Bolt at keys in the client. The most secure one is the one you reviewed, not the brand.
Can I migrate from one to the other to be safer?
Migrating does not fix it; you trade one hole profile for another. The security gain comes from locking RLS (Lovable) or removing keys from the client (Bolt), not from switching tools.
Who runs the review at RET?
Gabriel Lima Ferreira, founder and lead pentester, with authorization and a tight scope.