159k Lovable Apps Scanned: Many Expose Chats and Passport Data via Misconfigured Supabase APIs
bibryam · x · 2026-11-15
Crissy Field, working with Handelsblatt, examined 159,041 projects built on Lovable and found many apps exposing personal and confidential data—including private chats and passport details—through poorly secured Supabase APIs, accessible without login. Lovable, the Swedish no-code AI app builder descended from GPT Engineer, markets zero-technical-skill development but its Terms & Conditions place all responsibility for app security and data handling on customers. As the author puts it: AI democratized code generation faster than security expertise.
More from coding & agent
- Rust + wgpu rewrite renders 250k-file dependency graph at 60fps on M3 — IgorCarron · 2026-11-15
- Agents Orchestration Is Mostly Token Furnaces Now, Argues Dev — pvncher · 2026-11-15
- DataTalksClub Founder Launches Full-Time AI Academy in Germany, Tuition State-Funded — Al_Grigor · 2026-11-15
- How far can a company take AI? Greg Isenberg's 49-point playbook — FinanceYF5 · 2026-11-15
- TensorFold PR fixes MCP servers blocked by macOS sandbox over dyld framework loading — AIFlow_ML · 2026-11-15
- Alexey Grigorev: agent instructions shouldn't describe their tools — Al_Grigor · 2026-11-15