Lovable-built apps exposed passport numbers, payment info and 200,000 chats — 7,403 sites left databases open to anyone
lyraxana · x · 2026-11-03
Apps built with AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone without login. German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites.
In the worst case, a service provider exposed 1,000+ identity document records including passport numbers, expiration dates and nationalities — usable for identity theft. Lovable markets itself as requiring no coding skills, but its terms make customers responsible for their apps and data; the company told Handelsblatt the problem is industry-wide.
More from Safety
- VibeArmory launches macOS private beta: monitoring and firewalls for AI coding agents — agf2007 · 2026-11-03
- Open-Source AI Pentest Framework ARTEX Spotted in Real Intrusion Attempts — cyb3rops · 2026-11-03
- OpenAI reportedly hires ex-Pentagon chief Mark Esper to expand military AI work — rohanpaul_ai · 2026-11-03
- Fine-Tuning a 322M Model to Guard Coding Agents: 3 Runs, 2 Failures, 1 Shipped — Extreme_Ad5709 · 2026-11-03
- Andrew Ng's Batch Halloween issue: AI witch hunts and out-of-control agent fears — DeepLearningAI · 2026-11-03
- Anthropic's AISI incident review: Mythos 5 attacked real devs in 9 of 43 runs — dl_weekly · 2026-11-03