Thousands of web apps built with Lovable, the Swedish AI startup that turns plain-language prompts into working software, left personal and confidential data readable by anyone without a login, according to an analysis by German security firm Crissy Field, carried out with the newspaper Handelsblatt.[1]
Related: Mistral’s Managed Agents Push.
What the researchers found
Using data from the open web archive Common Crawl, the firm identified 159,041 Lovable projects created between December 2025 and September 2026. Of those, 34,545 used the database service Supabase, and 24,664 sent database records as soon as the page loaded.[1]
By making further read-only requests, the researchers found tables containing email addresses on 7,403 of those sites, about 30%. The firm cautioned that the figure is not a confirmed leak rate, because some addresses may be public or test data and the sample is not representative of all Lovable apps.[1]
The worst cases
A German lifestyle forum exposed more than 80,000 profiles with names, email addresses and birth dates, plus more than 200,000 chat messages. Event organizers and restaurants exposed tens of thousands of ticket and food-sale records, including phone numbers, addresses and payment information.[1]
One service provider exposed more than 1,000 records with identity document details, including passport numbers. Other open content included contracts, invoices, photo albums and, in one case, 280,000 emails sent to a provider’s customers. The firm said it could not establish whether any of the data had been misused.[1]
Why it happens
Lovable’s marketing stresses that no technical knowledge is needed, but its terms place responsibility for apps and data on customers, the researchers noted. Because Lovable’s database setups follow recurring patterns, one misconfiguration that works against one app can often be found in others.[1] The firm did not publish how to access the data.[1]
“Automated checks are no substitute for a professional security assessment,” Crissy Field wrote, urging builders to have access permissions reviewed before handling real customer data.[1] Handelsblatt shared the findings with Lovable.[1]
More in AI news and our AI companies guide.
Sources
Read next in Artificial Intelligence
Artificial IntelligenceLangChain Raises $300 Million at a $3 Billion Valuation as Businesses Race to Manage AI Agents
Artificial IntelligenceOpenAI Disbands Its Stand-Alone Robotics Team, Betting General AI Models Can Run Robots
Artificial IntelligenceOpenAI Launches ChatGPT Wallet So Its ‘Dots’ AI Agents Can Shop and Pay for Users
Most read this week
- Finland Confirms Strike on Russian Warship in Gulf of Finland; Ukraine’s SBU Claims Drone Attack
- U.S. Envoys Witkoff and Kushner Hold Talks With Putin in Moscow, Then Head to Dublin to Brief Zelensky
- Israeli Strike on Gaza’s Nasser Hospital Kills Six, Including a Surgeon, Health Ministry Says
- Nvidia Board Hires Wachtell’s Joon Kim to Lead Huang Probe as Shares Fall 5.47% and an Investor Sues
- Drones Kill Workers at Zaporizhzhia Nuclear and Thermal Plants, IAEA Says, as Russian Strikes Hit 5 Substations
Latest
- Congo Offers to Drop Lumumba if Rwanda Pulls Mushikiwabo Before Monday’s Francophonie Vote
- Bahrain Says It Intercepted Iranian Drones Aimed at Riffa Air Base, Iran’s Second Attack in Three Days
- The Boston House Will Shelter Up to 22 Families of Children With Cancer Through the Holidays
- About Half of Drinkers on GLP-1 Drugs Say They Cut Back, Harvard and McLean Survey Finds
- Tufts Medical Center Researcher Follows a 102-Year-Old and His Daughter for Clues to Healthy Aging
Get The Boston Report Briefing
Our free weekly email with the most important stories from Boston and the world. Unsubscribe anytime.
Free. We never sell your address. Privacy policy