A study of more than 159,000 Lovable projects reveals that many apps built on the platform display personal data without requiring users to log in. This includes passport details, payment information, and chat messages.
According to research by the German security firm Crissy Field, poorly configured Supabase databases are the cause. The researchers used datasets from the open web archive Common Crawl and identified 159,041 Lovable projects published between December 2025 and September 2026. Of these, 34,545 used Supabase.
On 24,664 websites, records from Supabase were already visible upon loading, without requiring a login or any other interaction. This doesn’t necessarily pose a problem, as that data may be intended for public display. However, by making additional read-only requests with the same API key, the researchers could view more database content. On 7,403 of those sites (30 percent), they found records containing email addresses in 10,560 tables.
According to the researchers, this percentage does not represent a confirmed breach rate. Email addresses could also be public contact addresses or test data. At the same time, this method does not find personal data without an email address. Furthermore, the sample is not representative of all Lovable apps.
Lovable converts plain-language descriptions into working web applications and targets people without programming experience.
From passport numbers to WhatsApp messages
A German lifestyle forum leaked more than 80,000 profiles containing full names, email addresses, dates of birth, and gender, plus over 200,000 chat messages. Event organizers and restaurants exposed tens of thousands of ticket and meal-sales records, including phone numbers, addresses, payment details, and ticket codes.
The most serious case? A service provider leaked more than 1,000 records containing identity information, including passport numbers, expiration dates, and nationalities. In addition, the researchers found contracts, invoices, photo albums, internal WhatsApp communications, and, in one provider’s case, 280,000 customer emails. It could not be determined whether the data was actually misused.
According to the researchers, database integrations at Lovable consistently follow the same patterns. As a result, an attack that works on one app can also be applied to other apps with little additional effort. They recommend having experts review access rights, interfaces, and user-account separation before an app begins processing real customer data. Lovable’s own database functions, available since late 2025, were not included in the investigation.
Tip: Lovable valued at 13.3 billion after new investment round