Over 7,000 apps built on AI platform Lovable exposed user data including passports and payment details due to missing authentication.
AI & Agents ·
A security analysis of over 159,000 projects built on Lovable, an AI platform that generates web applications from natural language descriptions, found that 7,403 apps exposed user data without requiring authentication. The exposed information included email addresses, passport numbers, payment details, and private communications. Researchers identified the vulnerability by examining how these applications handled data from Supabase, a database service widely integrated into Lovable projects, discovering that roughly 30% of the 24,664 websites sending database records on initial load contained tables with email addresses accessible without login.
The gap between Lovable's marketing promise of accessible, no-code application development and actual security responsibility creates a structural risk. While the platform emphasizes ease of use for users with minimal technical knowledge, its terms place data protection obligations on customers themselves. Lovable's integration with third-party services like Supabase makes misconfigurations particularly consequential, as developers unfamiliar with security best practices may unknowingly leave sensitive records publicly accessible.
The analysis focused specifically on Supabase integrations and read-only API access patterns, leaving open questions about exposure through Lovable's own database features introduced in late 2025 and similar misconfigurations on other platforms. The researchers acknowledge that email-based identification of personal data has inherent limitations—some addresses may be intentionally public or test data—meaning the 30% figure reflects potential rather than confirmed leaks.