Research finds 24,664 Lovable apps exposing sensitive data without login

·2026.11.15 02:43

Key point

Analysis of 159,041 Lovable projects identified widespread Supabase misconfigurations allowing unauthorized access to passports, chat logs, and financial records.

1 / 3

Details

Researchers analyzed 159,041 Lovable projects and found 24,664 websites sending Supabase database records upon load without requiring authentication.
Further read-only requests exposed email addresses in 10,560 tables across 7,403 websites, with specific cases revealing over 80,000 user profiles, 200,000 chat messages, and over 1,000 passport records.
The study highlights a gap between Lovable's marketing of no-code simplicity and its terms of service, which place data security responsibility on the customer.
Recurring database integration patterns in AI-built apps make it easier for attackers to identify and exploit similar misconfigurations across multiple applications.

ai-infrastructure privacy vibe-coding data-security supabase lovable

Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.