From the blog post:

  Using datasets from the open web archive Common Crawl,
  we identified and analyzed 159,041 Lovable projects from
  December 2025 to September 2026. Of these, 34,545 used
  Supabase.
  
  24,664 websites sent database records from Supabase as
  soon as they loaded, without requiring a login or any
  other interaction. That alone is not a security issue:
  the data may be intended for public display. But by
  making additional read-only requests, we were able to
  retrieve more database content. We found records
  containing email addresses in 10,560 tables across 7,403
  of the 24,664 websites (30%).

What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information.

Edit: That's 15,9% of all Lovable websites that use Supabase.