This already happened
Real incidents, not hypotheticals.
Every claim on this page is sourced and linked — NVD, CISA, or the vendor's own security writeup. No invented statistics.
The anchor case
CVE-2025-48757 — 170+ real apps, exactly this pattern.
In May 2025, security researcher Matt Palmer disclosed that 303 endpoints across 170 real apps built with Lovable — 10.3% of the projects he analyzed — could be read or written by anyone, unauthenticated, because Row Level Security was left off. NVD rated it CVSS 9.3, critical, CWE-863 (incorrect authorization). NVD's own description: “An insufficient database Row-Level Security policy in Lovable… allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites.”
One detail worth sitting with: the vendor's own response disputed that this was a Lovable bug at all — their position was that customers are responsible for protecting their own application data. Whether or not you think that's fair, it's the reality every builder on every AI coding tool ships into. RLS is off by default on new Supabase tables, and nobody except you is going to turn it on.
This is exactly check 1 of our 16 — RLS per table — on every scan, every hour, every 48 hours, for as long as you're on retainer.
NVD: CVE-2025-48757 → · Supabase's own 2025 security retro →
Supply chain
Shai-Hulud — a self-replicating npm worm.
Starting September 2025, a worm nicknamed Shai-Hulud spread through the npm registry: attackers compromised a maintainer's account via phishing, published malicious versions of their packages, then used the stolen credentials to infect every other package that maintainer owned — self-replicating without further human involvement. CISA issued an alert. A second, more aggressive wave (“Shai-Hulud 2.0”) hit in November 2025, compromising hundreds more packages and, in some cases, attempting to destroy the infected machine's home directory.
Partial coverage: our dependency slop-squatting check flags packages that look invented or suspiciously new in your package.json — a related but narrower problem than a worm compromising an already-trusted package after installation. Full dependency-vulnerability scanning needs source access, which is a roadmap item, not live today.
Awareness, not a claim of coverage
CVE-2025-29927 — Next.js middleware bypass.
A CVSS 9.1 vulnerability disclosed in March 2025: a crafted request header (x-middleware-subrequest) could trick vulnerable Next.js versions into skipping middleware entirely — including whatever auth checks your middleware was supposed to enforce.
Included here for awareness, with two honest caveats. First: Vercel confirmed apps hosted on Vercel were never affected by this one — the platform's own request handling doesn't expose the vulnerable path. Second, and more important: this is a hosting/source-layer issue, not something our anon-key, external, database-focused scan can detect at all. Catching this class of bug would need source access — the not-yet-built GitHub App integration on our roadmap, not a claim we make today.
Don't be the next one
Find out if your app has the same gap.
The RLS pattern behind CVE-2025-48757 is check 1 of the 16 ShipLock runs against your live Supabase project, on every audit and every automated pass after.