Researchers report sensitive data exposed in Lovable-built apps

An app can look finished while its database still leaves the door open.

What happened

Researchers have reported exposed passport details, private messages and other sensitive records in applications built with Lovable.

The investigation documented access to data without a login. The researchers warned that their sample was not representative of all Lovable apps, so its findings cannot establish a platform-wide exposure rate.

The investigation first received coverage on 2 November, with additional reporting on 3 November 2026.

Why it matters

Database permissions determine who can read or change records. If those controls are wrong, a polished interface offers little protection for the information underneath it. The reported exposures concern sensitive data, rather than a cosmetic product flaw.

The bigger picture

As more people build apps with AI assistance, secure defaults and understandable access controls become more consequential. The investigation supports scrutiny of the affected applications, while its sampling limits rule out a reliable estimate for the whole platform.