Lovable: Many Apps Built on the Platform Expose Sensitive Data
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Crissyfield researchers, working with Handelsblatt, examined 159,041 Lovable-built web projects and found that 24,664 loaded Supabase database records without login, with about 30% of the sampled sites exposing email addresses. Exposed data included profiles, ticket sales, identity document details, and internal communications.