{"slug": "lovable-many-apps-built-on-the-platform-expose-sensitive-data", "title": "Lovable: Many Apps Built on the Platform Expose Sensitive Data", "summary": "An analysis of 159,041 Lovable projects built between December 2025 and September 2026 found that 7,403 of 24,664 websites examined exposed database records containing email addresses without requiring a login, according to research conducted in collaboration with Handelsblatt, which published Lina Knees' report on November 2, 2026. Of the 159,041 projects, 34,545 used Supabase, and additional read-only requests surfaced email-address records in 10,560 tables across 30% of the 24,664 sites that sent Supabase data on page load. The researchers cautioned that the 30% figure is not a confirmed data leak rate, since email addresses may be public contact addresses or test data, while personal records without email addresses would be missed.", "body_md": "# Lovable: Many Apps Built on the Platform Expose Sensitive Data\n\n**AI makes it easier to build your own web applications, but handling sensitive data still requires special\ncare. We examined 159,041 Lovable projects and found many cases where personal and confidential information was\naccessible without logging in.**\n\n## About Lovable\n\nLovable is a Swedish AI startup founded in Stockholm in 2023 by Anton Osika and Fabian Hedin. The platform turns\nplain-language descriptions into web applications and is designed to be accessible even to *people with little\nor no programming experience*.\n\nLovable grew out of Osika’s open-source project “GPT Engineer”, released in 2023. The project evolved into the GPT Engineer App before being renamed Lovable in late 2024 and launching publicly that November.\n\n## The Promise\n\nLovable can build impressively sophisticated web projects with AI, from static websites to full applications\nwith user management and database connections. But as soon as an application handles confidential information,\none question becomes crucial: **Is that data protected against unauthorized access?**\n\n[In its marketing](https://lovable.dev/blog/what-is-vibe-coding), [Lovable\nrepeatedly](https://lovable.dev/blog/2025-01-30-why-non-tech-founders-no-longer-need-a-developer-to-launch-software)\n[emphasizes](https://lovable.dev/en/founders) [that no technical knowledge is needed to build\nprojects](https://lovable.dev/vibecoding). This can give the impression that the platform takes care of security\ntoo. Yet Lovable’s Terms & Conditions place responsibility for applications and data handling on the\ncustomers themselves.\n\nThat leaves a troubling gap between the promise of an easy-to-use, all-in-one service and the responsibilities customers are expected to take on.\n\nAgainst this backdrop, we investigated how well sensitive data in Lovable applications is protected, in\ncollaboration with [Handelsblatt](https://www.handelsblatt.com/). [Lina Knees reported on the findings on\nNovember 2, 2026 (in\nGerman)](https://www.handelsblatt.com/technik/ki/lovable-experten-finden-datenluecke-bei-beliebter-ki-coding-plattform/100264923.html).\n\n## Research Question\n\nWe wanted to find out whether sensitive data in Lovable applications was accessible without logging in. We looked separately at data sent when a website first loaded and additional content we checked by making further read-only requests with the same API key.\n\nThe result: **We found many clear examples of sensitive data left unprotected.**\n\n## Methodology\n\nWe focused on the database service [Supabase](https://supabase.com/). Its integration is relatively easy to\nanalyze, and we believe it is the most widely used database service among Lovable projects. Lovable’s own\ndatabase features, introduced in late 2025, are still less widely used. Similar misconfigurations may occur\nthere too, but we did not examine them in this analysis.\n\nUsing datasets from the open web archive [Common Crawl](https://commoncrawl.org/), we identified and analyzed\n**159,041 Lovable projects** from *December 2025 to September 2026*. Of these, 34,545 used Supabase.\n\n**24,664 websites** sent database records from Supabase as soon as they loaded, without requiring a login or any\nother interaction. That alone is not a security issue: the data may be intended for public display. But by\nmaking additional read-only requests, we were able to retrieve more database content. We found records\ncontaining email addresses in **10,560 tables** across **7,403** of the 24,664 websites (30%).\n\n## Limitations\n\nEmail addresses can help identify records containing personal data, but they may also be public contact addresses or test data. At the same time, this approach misses personal records that contain no email address. These effects partly offset one another, though we could not establish to what extent. The 30% figure should therefore not be read as a confirmed data leak rate. It applies only to the 24,664 websites we examined more closely. Our sample, drawn from Common Crawl, is also not representative of all Lovable applications.\n\nWe retrieved only parts of the datasets rather than downloading them in full. The figures below reflect the records we actually downloaded; the affected datasets may contain more. We are not publishing details of how to access them, as doing so could make further access easier.\n\n## Data Leaks\n\nWe found many serious cases of exposed data, including:\n\n- A German lifestyle forum exposed **more than 80,000 profiles** containing full names, email addresses, dates\nof birth, and gender information.**More than 200,000 chat messages** were also accessible.\n- Several event organizers and restaurants exposed **tens of thousands of records relating to ticket and food\nsales** , with no login required. The records we inspected included email addresses, phone numbers, postal\naddresses, payment information, and ticket codes.\n- A property management company exposed AI-generated summaries of internal emails containing sensitive information about tenants, property owners, and business partners.\n- In a particularly serious case, a service provider exposed **more than 1,000 records containing identity\ndocument details** , including**passport numbers** ,**expiration dates** , and**nationalities** . These highly\nsensitive identity details could be used for identity theft.\n- Other accessible content included tens of thousands of **contracts** ,**invoices** ,**personal photo albums** ,\nand**internal WhatsApp communications** .\n- We also found numerous newsletter subscriptions, waiting lists, and contact and support inquiries. In one case, **280,000 emails sent** to a provider’s customers were accessible.\n\nDepending on what it contains, exposed data like this could be used for phishing, ticket fraud, or identity theft. We could not establish whether any of it had been misused.\n\nHandelsblatt contacted Lovable with the findings of our investigation.\n\n## Implications\n\nOur analysis shows that many Lovable applications leave even highly sensitive data unprotected, with potentially serious consequences for the people affected.\n\nAccess control mistakes can happen in any application, whether written by people or built with AI. With Lovable, database integrations follow recurring patterns, making it easier for attackers to look for similar misconfigurations across many applications. An approach that works against one app may then work against others with little extra effort. Users without a technical background also face a harder task spotting and preventing these flaws.\n\nAn easy-to-use development platform does not remove the need for an expert review of access permissions before an application handles confidential data.\n\nAutomated checks **are no substitute for a professional security assessment**.\n\nBefore an application handles real customer or business data, its access permissions, interfaces, and separation between user accounts should be reviewed. These checks should be repeated after significant changes. If the necessary expertise is not available in-house, bring in qualified support.\n\nIf you would like help securing your application, please get in touch.\n\n*Note: This research report presents a more recent analysis and updated figures compared with the Handelsblatt\narticle published on November 2, 2026.*\n\n## Talk to an expert\n\nGet in touch for an informal conversation. We'll look at your current situation and work with you to find the right solutions.\n\n[Contact an expert](mailto:hello@crissyfield.de)", "url": "https://wpnews.pro/news/lovable-many-apps-built-on-the-platform-expose-sensitive-data", "canonical_source": "https://www.crissyfield.de/research/lovable-en/", "published_at": "2026-11-02 15:45:23+00:00", "updated_at": "2026-11-02 15:51:25.989453+00:00", "lang": "en", "topics": ["ai-safety", "ai-products", "ai-startups"], "entities": ["Lovable", "Supabase", "Handelsblatt", "Lina Knees", "Anton Osika", "Fabian Hedin", "Common Crawl", "GPT Engineer"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/lovable-many-apps-built-on-the-platform-expose-sensitive-data", "markdown": "https://wpnews.pro/news/lovable-many-apps-built-on-the-platform-expose-sensitive-data.md", "text": "https://wpnews.pro/news/lovable-many-apps-built-on-the-platform-expose-sensitive-data.txt", "jsonld": "https://wpnews.pro/news/lovable-many-apps-built-on-the-platform-expose-sensitive-data.jsonld"}}