Vulnerability / research

Researchers find personal records readable without login in Lovable-built apps

Reported

Published here

What happened

Researchers found private data exposed by database permissions in apps built using Lovable and Supabase. One German forum exposed over 80,000 profiles and 200,000 messages. Another service exposed over 1,000 identity-document records.

Parties and reporting

AI tools and systems: Lovable AI app builder, Application-managed Supabase databases

Outcome

Of 24,664 sites that loaded database records without login, 7,403 returned records containing email addresses. The researchers demonstrated sensitive exposures in specific apps. They could not establish malicious use or a complete remediation count.

Operating lesson

Test anonymous and cross-account access to each sensitive table before launch, then repeat those tests after permissions or generated application code change.

Evidence and limits

The collaborating newspaper first reported these findings November 2. The updated sample covers projects found in Common Crawl. Email addresses can be public or test data. The 30% figure applies only to the examined subset and does not measure a platform-wide breach rate.

Sources