Lovable and Supabase are a truly terrible combo, unless you have high confidence that someone who has been convinced to “build an app” with no technical skills based on the promise of an advert on the Tube is going to magically get Postgres row-level security correct.
The moment you see the string “Lovable” in source code, you know you are in for complete amateur hour dogshit and giggles.