Lovable: Study Finds Personal Data Accessible Without Login Across Thousands of Apps
German security firm Crissy Field analyzed 159,041 projects built with Lovable. Out of 24,664 sites returning Supabase data right upon loading, 7,403 allowed reading database tables containing email addresses, and in some cases passport numbers or payment details.
The promise of “vibe coding” has run headfirst into a very practical question: who is protecting the data? German security firm Crissy Field examined 159,041 projects built using Lovable, the Swedish platform that turns natural-language descriptions into full web applications. The result: on thousands of sites, personal information—sometimes highly sensitive—was readable without any login required. The investigation, conducted alongside German business daily Handelsblatt (published November 2, 2026), is detailed in a report published by Crissy Field with updated figures.
What the Study Measured
Crissy Field focused on Supabase, the database service it identified as most widely used by Lovable projects. Lovable’s native databases, launched in late 2025, were not included in the analysis.
| Step | Count |
|---|---|
| Lovable projects identified in Common Crawl (Dec. 2025 to Sept. 2026) | 159,041 |
| Projects using Supabase | 34,545 |
| Sites returning Supabase records on page load without authentication | 24,664 |
| Sites where tables containing email addresses were readable | 7,403 (30%), across 10,560 tables |
The first figure is not inherently a vulnerability: an application may intentionally display certain public data. The problem arises at the next stage. Using straightforward read-only queries paired with the same API key used by the site, researchers were able to read other database tables. Crissy Field has kept its exact access methodology private to avoid facilitating further intrusions, and only extracted data samples from the databases.
From Passports to Private Messages
The examples highlighted in the report are serious:
- A German discussion forum exposed over 80,000 profiles (names, emails, dates of birth) and more than 200,000 messages;
- Event organizers and restaurants left tens of thousands of sales records open, including phone numbers, physical addresses, payment details, and ticket codes;
- A real estate management firm exposed AI-generated summaries of internal emails regarding tenants and partners;
- A service provider exposed more than 1,000 records containing passport numbers, expiration dates, and nationalities;
- Elsewhere: contracts, invoices, photo albums, internal WhatsApp chats, and 280,000 emails sent to customers of a vendor.
Crissy Field noted that it could not determine whether this information was actively exploited, but warned that such data could easily be used for phishing, ticket fraud, or identity theft.
Caveats Surrounding the 30% Figure
The report urges caution regarding its own headline metric. An email address might simply be a public contact or test data; conversely, personal profiles lacking email fields slipped through undetected. The 30% figure applies only to the 24,664 sites analyzed in detail, and the Common Crawl sample is not representative of all Lovable applications. It is therefore not a confirmed breach rate.
Who Is Responsible?
Crissy Field highlighted a disconnect: Lovable emphasizes that no technical skills are needed, yet its terms of service place full responsibility for applications and data processing onto customers. According to India Today, citing Handelsblatt, Lovable responded that the issue was not unique to its platform and represented an industry-wide problem. We have not found an official public statement from the company at this stage.
Researchers acknowledged that access-control oversights also occur in hand-written code. However, with Lovable, database integrations follow repetitive templates: an approach that works against one app can easily be repeated across many others. Furthermore, users without technical backgrounds are ill-equipped to spot these vulnerabilities. Their advice: have permissions, interfaces, and account separation reviewed before handling real customer data, and repeat the audit after every major change.
Our take
This issue is not unique to AI: a misconfigured database is still a misconfigured database, whether hooked up by a human or an agent. Yet app-generation tools vastly multiply the number of projects pushed live by people who do not realize that a database without proper access controls can be read far beyond what the user interface displays. The study proves neither a massive leak nor malicious exploitation, and its sample is not representative; however, it clearly shows that “no-code” does not mean “no-security.” For these platforms, the priority must now shift toward making secure configurations the default and blocking deployments whenever sensitive records remain exposed, rather than passing the buck to users. If you have deployed an app like this, test it while logged out and have its security rules audited before storing any real data.
Sources
- Crissy Field — Lovable: Many Apps Built on the Platform Expose Sensitive Data (research report) Primary source
- India Today — AI app-maker Lovable apps expose personal details, researchers find thousands of cases (November 3, 2026) Secondary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
