Apps built with Lovable left passport numbers and 200,000 chat messages readable without a login
Crissy Field scanned 159,041 projects and found email records on 7,403 sites built with Lovable.
By Ryan Merket · Published
Primary source: www.crissyfield.de
Why it matters
Lovable sells software creation to people who cannot code, and Crissy Field found that database access rules those builders may not know to check were left open at scale. As Lovable expands from generating apps to hosting and running them, the line between customer misconfiguration and platform responsibility gets harder to defend with terms of service alone.
Apps built with Lovable left passport numbers, payment information and more than 200,000 chat messages readable without a login, according to research published by Hamburg application-security firm Crissy Field in collaboration with German business daily Handelsblatt. Crissy Field examined 159,041 Lovable projects and found records containing email addresses in 10,560 tables across 7,403 sites.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.