>In its marketing, Lovable repeatedly emphasizes that no technical knowledge is needed to build projects. This can give the impression that the platform takes care of security too. Yet Lovable’s Terms & Conditions place responsibility for applications and data handling on the customers themselves.
My point is that the way Lovable websites are generated pretty much made no auth or mistake prone from scratch auth stack the default path with no regard to the security problem down the line, and the people they are marketing to are not decent developers or developers at all really, but people who doesn't have much knowledge about software, which is irresponsible.
This only really works with 1-person apps though. If you need multiple users then you have to match the login with specific database records to make sure you're only exposing the right stuff.
I guess that is to say, even if your authentication is great, you can still botch the authorization.