SUPAPWN: HACKING OUR WAY INTO LOVABLE'S OFFICE AND HELPING SECURE SUPABASE

Summary from the TLDR InfoSec newsletter

SupaPwn is a multi-stage exploit chain affecting outdated Supabase environments, where weaknesses in privilege controls, host configurations, and cloud credential handling allowed attackers to escalate far beyond expected tenant-level permissions, even reaching infrastructure belonging to other customers. AI tooling accelerated reconnaissance and exploit development, helping researchers validate the chain quickly. Supabase and Lovable patched all affected systems within a day, limiting impact to a small set of outdated deployments.