Lovable AI platform lets thousands of apps expose passport data and private messages

A new security report from Crissy Field GmbH reveals that dozens of applications built with the Swedish AI‑coding platform Lovable unintentionally expose personal data, including passport numbers and hundreds of thousands of private messages. The findings raise urgent questions for creators who rely on low‑code AI tools to launch web services.

What did the Lovable security study uncover?

According to the research report released on November 14, 2026, the investigators examined 159,041 Lovable projects that were publicly reachable between December 2025 and September 2026. The study focused on projects that used Supabase as a backend database because its integration is common and easy to audit. The researchers discovered that many applications returned database records as soon as the page loaded, without requiring any authentication. By issuing additional read‑only API calls with the same key, they were able to retrieve further data that should have been protected.

How extensive was the data exposure across Lovable projects?

Out of the total sample, 34,545 projects employed Supabase. Within this subset, 24,664 websites delivered database records on first load, a behavior that is not automatically a breach but often indicates a misconfiguration. When the team performed deeper probing, they found email addresses in 10,560 tables spanning 7,403 of those sites – roughly 30% of the examined cohort. The report stresses that the 30% figure should not be interpreted as a definitive leak rate because the method only captures records that contain email addresses and may miss other personal data.

Which types of sensitive information were found exposed?

The analysis catalogued several high‑impact cases:

• A German lifestyle forum leaked more than 80,000 user profiles, including full names, dates of birth, gender, and over 200,000 chat messages.
• Event organizers and restaurants unintentionally published tens of thousands of ticket‑sale and food‑order records, exposing email addresses, phone numbers, postal addresses, payment details, and ticket codes.
• A property‑management service left AI‑generated email summaries that referenced tenants, owners and business partners.
• A service provider exposed more than 1,000 records containing identity‑document details such as passport numbers, expiration dates and nationalities – data that is directly usable for identity theft.
• Additional leaks included contracts, invoices, personal photo albums, internal WhatsApp chats, newsletter subscription lists and, in one case, 280,000 outbound emails that were publicly accessible.

Why are Lovable apps particularly vulnerable?

Lovable markets itself as a platform that lets anyone turn plain‑language descriptions into functional web applications without any programming knowledge. Its Terms & Conditions place the responsibility for data handling squarely on the customer, while the platform’s marketing emphasizes ease of use rather than security. This creates a mismatch: users may assume the service automatically secures databases, yet the underlying Supabase integration is essentially a vanilla connection that requires the developer to configure row‑level security, API keys and authentication flows. Because many creators lack a security background, they often overlook these settings, leaving default‑open permissions in place.

How can developers safeguard Lovable‑built applications?

The report concludes that automated checks are not a substitute for a professional security assessment. Developers should:

1. Review Supabase policies – Ensure that Row Level Security (RLS) is enabled and that policies explicitly restrict read and write operations to authenticated users.
2. Rotate API keys – Treat Supabase service keys as secrets; store them in environment variables and never embed them in client‑side code.
3. Add authentication layers – Use OAuth providers or email/password login to gate access to any endpoint that returns personal data.
4. Run regular penetration tests – Simulate unauthenticated requests to verify that no data leaks occur after updates.
5. Employ third‑party audits – If in‑house expertise is limited, engage qualified security consultants to audit the access control configuration.

What tools does Grafy offer to help assess and fix these issues?

Grafy’s Code studio (Grafy Code) provides a sandboxed environment where developers can prototype Supabase security rules, test API calls and iterate on authentication logic using real code snippets. By importing a Lovable‑generated project’s source files into Grafy Code, you can run unit tests that attempt unauthenticated reads and verify that the responses are appropriately blocked. For teams that prefer a higher‑level review, Reader (Grafy Reader) can ingest the Crissy Field PDF report, let you ask natural‑language questions about the findings, and extract actionable recommendations. Finally, Chat (Grafy Chat) lets you converse with multiple AI models to brainstorm remediation strategies, generate policy templates, or draft a security checklist tailored to your specific Lovable app.

---

Source: Crissy Field GmbH, “Lovable: Many Apps Built on the Platform Expose Sensitive Data”, published November 14, 2026.

Frequently asked questions

Did the study find that all Lovable apps leak data?

No. The study examined a large sample and identified a significant subset that exposed data, but many Lovable projects either did not use Supabase or correctly configured access controls. The 30% figure refers only to sites where email addresses were discovered in exposed tables.

Can the exposed passport information be used for identity theft?

Yes. The report documents more than 1,000 records containing passport numbers, expiration dates and nationalities. Such details are precisely the data that fraudsters need to fabricate counterfeit identity documents.

How can Grafy Code help me secure a Supabase backend?

Grafy Code lets you write and execute Supabase security policies in a contained environment, run automated tests that mimic unauthenticated requests, and iterate quickly on fixes before deploying changes to production.

---

Source: Hacker News — front page — Lovable apps expose passport details and more than 200K private messages