Lovable apps expose passport details and more than 200K private messages
An investigation into Lovable, an AI platform for building web applications, uncovered widespread data leaks, exposing passport details, private messages, and financial records across thousands of user-created apps. This story resonates on HN by highlighting the perilous gap between AI's promise of easy development for non-technical users and the critical, often overlooked, need for robust security. It fuels ongoing debates about platform responsibility, the quality of AI-generated code, and the real-world consequences of a 'move fast and break things' approach to sensitive data.
The Lowdown
A recent investigation by Crissyfield, in collaboration with Handelsblatt, has revealed significant security vulnerabilities within applications built using Lovable, an AI-powered platform designed to enable users with little to no programming experience to create web applications. Despite Lovable's marketing emphasizing ease of use, the research found that many applications built on the platform were exposing highly sensitive user data.
- Lovable, a Swedish AI startup, allows users to generate web applications from plain-language descriptions, including those with user management and database connections.
- The research analyzed 159,041 Lovable projects, focusing on the 34,545 that integrated with Supabase, a popular database service.
- Of these, 7,403 websites (30% of those serving Supabase data on load) were found to expose email addresses and other sensitive information through simple read-only API requests.
- Specific data leaks included: over 80,000 user profiles and 200,000 chat messages from a German forum; tens of thousands of ticket and food sales records with PII; AI-generated summaries of internal emails; over 1,000 identity document records, including passport numbers and expiration dates; and numerous contracts, invoices, personal photo albums, and internal communications.
- The exposed data could facilitate phishing, ticket fraud, and identity theft.
- The core issue identified is a disconnect between Lovable's marketing, which suggests security is handled, and its Terms & Conditions, which place data handling responsibility squarely on the customer.
- The researchers stress that automated checks are insufficient and professional security assessments are crucial before handling confidential data.
This report underscores a critical tension in the AI-driven development landscape: the allure of rapid, accessible app creation versus the non-negotiable requirement for expert-level security practices, especially when dealing with personal and confidential information.
The Gossip
Culpability Conundrum: Pinpointing the Problem
The discussion heavily debated where the blame for these widespread data leaks primarily lies. Many commenters pointed fingers at Lovable's marketing, which promises effortless app creation for non-technical users while simultaneously offloading security responsibility onto those same users via its Terms & Conditions. Others highlighted Supabase's role, noting its historical default configurations that prioritized ease of onboarding over stringent security, potentially contributing to the misconfigurations. While AI enables non-experts to build apps, the consensus leaned towards platform providers and underlying service defaults bearing significant responsibility for ensuring basic security safeguards.
Algorithmic Anarchy: The AI Security Dilemma
Commenters explored whether AI is the fundamental cause of these security issues or merely an amplifier of existing problems. Some argued that AI-generated applications are inherently easier targets due to their sheer volume and the non-technical backgrounds of their creators, making them ripe for exploitation. Conversely, others contended that AI itself isn't the villain, but rather the irresponsible marketing and deployment strategies that encourage users to build complex systems without any foundational understanding of security. A pervasive concern was that the rapid pace of AI advancement is outstripping the industry's ability to ensure adequate security, creating a new class of vulnerabilities.
Regulatory Reckoning: The Call for Consequences
The conversation also delved into the legal and financial ramifications of such extensive data breaches. Commenters questioned whether GDPR authorities had been notified and if national data protection agencies were actively investigating. A strong sentiment emerged advocating for more stringent liability frameworks, with many calling for "real, stiff liability consequences" for companies and app owners who fail to protect sensitive data. The argument was that significant financial penalties would serve as a powerful deterrent and compel greater diligence in data security practices.
Code Quality Crisis: The Decline of Due Diligence
Many participants expressed profound frustration over what they perceived as a systemic decline in software engineering standards and a growing disregard for user safety, a trend exacerbated by the "move fast and break things" ethos and the recent AI boom. Comparisons were frequently drawn to other engineering disciplines, like civil engineering, which operate under much stricter safety protocols, highlighting the perceived laxity in software development. There was a palpable lament for a bygone era where code quality, security, and user well-being were prioritized, contrasting it with a current profit-driven environment where user harm is often seen as an acceptable externality of rapid development.
Investigative Integrity: The Ethics of Data Collection
A smaller but notable thread emerged questioning the ethical boundaries of the research methodology. One commenter specifically asked whether the researchers collected more data than was strictly necessary to prove the vulnerability, suggesting that by pulling extensive records, they might have crossed a line from 'white hat hacker' to potentially criminal activity. The author of the research post clarified that the full dataset collected was subsequently disclosed to Lovable, implying a responsible and ethical handling of the discovered information.