Lovable apps leak passport details and private messages
The story so far
Applications built on the Lovable platform exposed passport details and over 200,000 private messages without requiring login. These applications account for 30% of the 24,664 websites built on the Lovable platform, with database records accessible without login, including 7,403 websites containing email addresses. Serious cases include over 80,000 user profiles and 200,000 chat records from a German lifestyle forum, tens of thousands of ticket/sales records for event organizers/restaurants, internal email AI summaries from property management companies, and over 1,000 identity records containing passport numbers exposed by service providers. The 24,664 websites built on the Lovable platform immediately sent database records from Supabase upon loading, without login or any other interaction.
AI-written from the reports · Updated 10 minutes ago
Coverage timeline
Follow the coverage to see every side of the story.
- Hacker News · 300+Lovable platform-built apps expose passport details and over 200,000 private messages
Among the 24,664 websites built on the Lovable platform, 30% have database records accessible without login, including 7,403 websites containing email addresses; serious exposure cases include over 80,000 user profiles and 200,000 chat records from a German lifestyle forum, tens of thousands of ticket/sales records for event organizers/restaurants, internal email AI summaries for property management companies, and over 1,000 identity records with passport numbers exposed by service providers.
Heat over time
Not enough data yet to draw a trend.