Lovable apps expose passport details and more than 200K private messages

Researchers examining 159,041 Lovable projects—an AI platform for building web applications without coding experience—discovered that thousands of apps exposed sensitive data without authentication, including passport details and over 200,000 private messages. The analysis of 34,545 projects using the Supabase database service found that 24,664 websites transmitted unprotected database records upon loading, revealing a significant security gap between Lovable's promise of ease-of-use and the actual responsibility placed on users to secure their data.