Researchers at German application-security firm Crissy Field found sensitive personal and business information exposed in apps built with AI coding platform Lovable, including passport records and more than 200,000 chat messages.
The researchers’ report, produced with Handelsblatt, is based on an analysis of 159,041 Lovable projects collected from the Common Crawl archive between December 2025 and September 2026.
Of the projects examined, 34,545 used Supabase as a backend database. Researchers found that 24,664 sites returned database records without requiring a login when their pages loaded. Additional read-only requests revealed email addresses in 10,560 tables across 7,403 of those sites. Crissy Field cautioned that this 30% figure is not a confirmed data-leak rate: some email addresses may be public or test data, and the Common Crawl sample does not represent every Lovable application.
Among the examples, a German lifestyle forum exposed more than 80,000 user profiles and over 200,000 chat messages. A service provider left more than 1,000 identity records accessible, including passport numbers, expiration dates and nationalities. Other exposed records included ticket and food orders, payment details, contracts, invoices, personal photo albums and internal WhatsApp communications. The researchers could not determine whether the information had been misused.
Crissy Field attributed the exposures to missing or misconfigured database access controls in individual apps, rather than a breach of Lovable’s central platform. The researchers said the repeated patterns in Lovable’s Supabase integrations could make similar mistakes easier to find across multiple projects. The access-control failure resembles earlier Firebase misconfigurations that exposed plaintext passwords, although the current investigation focused on Supabase-backed apps.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
