Lovable Apps Exposed Passport Numbers and 200,000 Private Messages Without a Login

TL;DR

Thousands of apps built with Lovable have been handing their databases to strangers with no login required. German security firm Crissy Field, working with the business daily Handelsblatt, identified 159,041 Lovable projects in the Common Crawl web archive, covering December 2025 to September 2026, and probed how they treat data. Result: 7,403 apps served records with email addresses and other personal-looking data to anyone who asked, including a forum with more than 80,000 member profiles and 200,000+ chat messages, a service provider with 1,000+ passport records, and a business whose 280,000 customer emails were readable. Nobody hacked Lovable or Supabase. The apps shipped a database key that is public by design, with row-level security missing or too loose, and Lovable's Head of Security agreed with that diagnosis in the Hacker News thread where the report landed on Nov 14.

How the doors were left open

Lovable apps keep their data in Supabase, and Supabase apps send an anon key to every browser that loads them. That key is public by design: it identifies the project, the way a library card number identifies a patron. The card is harmless as long as the librarian, which Supabase calls row-level security, decides which shelves each visitor may pull books from. The apps Crissy Field found had sent the librarian home.

Of the apps that sent database records on first load, the researchers kept reading with additional read-only requests that used the key the page had already handed them. They retrieved only parts of each dataset rather than pulling everything, and they are withholding the method so it cannot be replayed casually.

The numbers, read carefully

The 7,403 apps are 30 percent of the 24,664 examined closely, and three caveats apply before you quote that figure anywhere. Email addresses can be public contact details or test data, and personal records with no email field slip past this method entirely, so the two errors pull in opposite directions. The Common Crawl sample is not representative of all Lovable apps. And Crissy Field could not establish whether anyone actually misused the exposed data. The examples below are confirmed. The rate is an estimate with error bars.

What strangers could read

• A German lifestyle forum: 80,000+ profiles with full names, email addresses, dates of birth and gender, plus 200,000+ chat messages.
• A service provider: 1,000+ identity document records with passport numbers, expiration dates and nationalities.
• Event organizers and restaurants: tens of thousands of ticket and food-sale records with phone numbers, postal addresses, payment information and valid ticket codes.
• A property management company: AI-generated summaries of internal emails about tenants, property owners and business partners.
• One provider: 280,000 emails sent to its customers. Elsewhere: tens of thousands of contracts and invoices, personal photo albums, and internal WhatsApp conversations.

What Lovable says

Igor, Lovable's Head of Security, answered the Hacker News thread directly. His diagnosis: the root cause in these apps was insufficient row-level security, "which is exactly what our scanning is built to catch." Lovable scans every app automatically before publish, offers a deeper SAST scan free for all users, can auto-fix findings in the background, and blocks publishing entirely when findings are critical.

The company told Cybernews the issue is a known, industry-wide Supabase configuration problem rather than a flaw in its AI, as Trending Topics reported. Both things can be true: the misconfiguration is a Supabase pattern, and Lovable is the platform funneling non-programmers into it by the hundred thousand. The marketing says you need no technical knowledge to ship an app; the terms and conditions put responsibility for data handling on the customer. This is also round two. A similar exposure in Lovable apps went public in 2025 as CVE-2025-48757, after which Lovable built the Security Scan.

Not just Lovable

Crissy Field's scan is the Lovable-shaped slice of a bigger pile. In October, UpGuard probed roughly 300,000 domains connected to Supabase and found readable tables on 16,326 databases, more than half showing signs of personal data; BleepingComputer covered the findings. Lovable, valued at $13.3 billion after its summer round, is simply the biggest name in the wave, and the wave made this failure scalable: because the platform wires database connections through the same template every time, a misconfiguration that works on one app can be replayed against thousands of its siblings with almost no extra effort. Bolt.new and v0 connect to Supabase the same way, and Replit and Cursor will generate a fresh backend on request. The vibe, it turns out, does not include a threat model.

If you ship apps this way

• Turn RLS on for every table. A table with row-level security disabled answers the public key; that is the whole bug.
• Write policies per table. Enabling RLS with no policies blocks anonymous reads; the dangerous middle ground is a policy like USING (true) added to make the app work.
• Treat the anon key as public, because it is sitting in your page source right now. Anything it must not read, RLS has to refuse.
• Test logged out. Open the app in a private window and watch the network tab, or query the REST endpoint with the key the page hands you. If you can see rows, so can a scraper written in ten minutes.
• Run the tooling and then a human: Lovable's Security Scan and SAST, Supabase's database linter, and a real review before an app touches customer data. Crissy Field's own closing warning is that automated checks are no substitute for a professional security assessment.

Key Takeaways

• Crissy Field analyzed 159,041 Lovable projects (Dec 2025 to Sep 2026) found via Common Crawl. 24,664 served database records with no login; 7,403 of those served records containing email addresses and other personal-looking data.
• Worst confirmed finds: 200,000+ chat messages and 80,000+ profiles from one forum, 1,000+ passport records from a service provider, and 280,000 customer emails at one business.
• No one broke into Lovable or Supabase. The public-by-design anon key plus missing or permissive row-level security did all the work.
• Lovable's Head of Security confirmed insufficient RLS as the root cause; the platform scans before publish, offers free SAST, auto-fixes findings, and blocks publishing on critical ones. A similar flaw went public in 2025 as CVE-2025-48757.
• The pattern is industry-wide: UpGuard found 16,326 readable Supabase databases across about 300,000 probed domains, and Bolt.new, v0, Replit, and Cursor ship the same class of generated backend.
• The 30 percent figure is a signal, not a leak rate. The sample is not representative, and the email-detection method both over- and under-counts.

Sources: Crissy Field research report, Handelsblatt, Hacker News thread with Lovable's response, Trending Topics, UpGuard, BleepingComputer.