Pull to refresh
Logo
What Changed
Following Why Sign Up
Lovable apps leak passport data through default database settings

Lovable apps leak passport data through default database settings

New Capabilities

Security researchers found 24,664 AI-built sites serving private records without a login

Today: Findings reach Hacker News

Overview

Updated 2 hours ago

A German security firm analyzed 159,041 websites built with Lovable, the AI app builder, and found 24,664 of them serving database records to any visitor, with no login required. The exposed material included more than 1,000 identity documents with passport numbers and over 200,000 private chat messages from a single German forum.

The cause is a configuration gap, not a software bug. Lovable apps store data in Supabase, a hosted database, and the browser fetches it using a public key embedded in the page. What that key can read depends on access rules called Row Level Security. When those rules are missing or too broad, the database answers anyone who asks.

Why it matters

Anyone who booked a table or uploaded an ID to an AI-built site may have had that data readable by strangers.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

159,041
Lovable projects analyzed
Sites identified through the Common Crawl archive from December 2025 to September 2026.
24,664
Sites serving data on page load
Websites that returned Supabase records to any visitor, without a login.
30%
Share of examined sites with email data
Email addresses appeared in reachable tables on 7,403 of the 24,664 sites.
200,000+
Private chat messages exposed
Messages from a single German lifestyle forum, alongside more than 80,000 profiles.
1,000+
Identity documents exposed
Records at one service provider included passport numbers, expiration dates and nationalities.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Anton Osika
Anton Osika
Co-founder and chief executive, Lovable
Leads Lovable
IA
Igor Andriushchenko
Head of security, Lovable
Responding to the Crissy Field findings
 Matt Palmer
Matt Palmer
Security researcher
Findings catalogued as CVE-2025-48757
 Lina Knees
Lina Knees
Reporter, Handelsblatt
Co-published the investigation

Organizations Involved

Lovable
Lovable
AI software startup
Platform whose apps were analyzed

Stockholm-based AI app builder that turns plain-language prompts into working websites and applications.
Supabase
Supabase
Open-source Postgres development platform
Changed defaults for new tables

Open-source backend service providing hosted databases, authentication and storage.
Crissy Field GmbH
Crissy Field GmbH
Security research firm
Published the investigation

German security research firm that analyzed 159,041 Lovable projects with Handelsblatt.
Handelsblatt
Handelsblatt
Business newspaper
Co-published the investigation

German business newspaper that co-published the Crissy Field investigation.

Timeline

2023 November 2026

8 events Latest: Today
Tap a bar to jump to that date

  1. Findings reach Hacker News

    Today Distribution

    A Hacker News post links to coverage of the report and draws hundreds of comments.

  2. Crissy Field and Handelsblatt publish findings

    Investigation

    Researchers report 24,664 sites serving records without login, including passport data and private messages.

  3. Default extends to existing projects

    Policy

    Supabase applies the default more widely, but tables that already exist keep their permissions.

  4. Opt-out becomes default for new projects

    Policy

    Supabase makes the setting the standard for newly created projects.

  5. Supabase adds opt-out for auto-exposed tables

    Policy

    Project owners can stop new tables being exposed through the web interface automatically.

  6. First exposure reported as CVE-2025-48757

    Research

    Matt Palmer finds 170 Lovable apps returning personal data to unauthenticated visitors.

  7. Lovable launches publicly

    Company

    The renamed platform opens to users, marketed at people with little programming experience.

  8. Lovable founded in Stockholm

    Company

    Anton Osika and Fabian Hedin build Lovable from Osika's open-source GPT Engineer project.

Scenarios

1

Lovable turns row-level security on by default

Possible Resolves by Q2 2027

Discussed by: Crissy Field researchers and security analysts

The report's main recommendation is that access permissions be locked down before apps handle real data. If Lovable changes its builder so new Supabase tables start with Row Level Security enabled, new apps would be closed by default. Existing apps would still need manual fixes.

2

Swedish privacy regulator opens inquiry into Lovable

Possible Resolves by Q2 2027

Discussed by: Handelsblatt and privacy lawyers

The exposed files include passport numbers and email addresses of EU residents, which fall under the General Data Protection Regulation. Sweden's privacy authority could open an inquiry into Lovable, which is based in Stockholm. An inquiry could lead to fines or orders to notify affected users.

3

Exposed datasets stay reachable into 2027

Likely Resolves by Q2 2027

Discussed by: Crissy Field and Supabase's own changelog

Supabase's default change protects new tables but leaves existing tables with their old permissions. Unless app owners manually fix access rules, the datasets Crissy Field found remain accessible. A re-scan would show whether the exposure shrank.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

2018-2019

Misconfigured Firebase databases (2018-2019)

Security researchers reported thousands of apps using Google's Firebase Realtime Database with weak or missing access rules, leaving user records readable by anyone who knew the database address.

Then

Google and app developers tightened rules on a case-by-case basis.

Now

Misconfigured backends became a recognized category of cloud data exposure, separate from hacked servers.

Why this matters now

The Lovable cases follow the same pattern: a backend service, a public client key, and access rules that were never set.

2017-2019

Exposed Amazon S3 buckets (2017-2019)

Companies including Accenture, Verizon and the Pentagon left cloud storage buckets publicly readable, exposing internal documents and customer data.

Then

Each company scrambled to close its buckets after public disclosure.

Now

Cloud providers added warning banners and block-public-access defaults.

Why this matters now

Defaults and warnings helped, but only for new storage. Existing buckets stayed open, the same gap Supabase now faces with existing tables.

Spring 2025

CVE-2025-48757 (2025)

Researcher Matt Palmer found 170 Lovable apps showcased on the platform returning personal data to unauthenticated visitors.

Then

The flaw was catalogued as a known vulnerability.

Now

The problem was treated as isolated; eighteen months later Crissy Field found the same pattern across thousands of sites.

Why this matters now

It shows the exposure was known before the 2026 report and had not been broadly fixed.

Sources

(5)
Crissy Field GmbH Sifted Hacker News Cybernews Pasquale Pillitteri