AI app-maker Lovable apps expose personal details, researchers find thousands of cases

AI app-maker Lovable is facing fresh security questions after researchers found sensitive data exposed across several projects. The findings include passport details, payment information and over 200,000 chat messages accessible without login.

In Short

• Lovable apps reportedly exposed passport and payment details
• Researchers found over 200,000 chat messages accessible
• Security investigation covered 159,041 Lovable projects

In the AI era, building apps or websites no longer requires hardcore coding skills. One such AI platform, Lovable, lets users simply describe what they want and let the technology do the heavy lifting. But a new security investigation suggests that making apps easier to build does not necessarily make them safer to use.

Researchers at German security firm Crissy Field examined 159,041 projects built using Lovable and found several cases where sensitive information was accessible without requiring a login. The exposed data included passport details, payment information, personal records and more than 200,000 chat messages.

The findings were reported first by German business publication Handelsblatt, which raises fresh questions about how safely AI-generated applications handle personal information.

Lovable apps reportedly exposed sensitive customer data

According to Crissy Field, 34,545 of the projects examined used Supabase, a database service commonly integrated with Lovable. Researchers found that 24,664 websites sent database records when they loaded, without requiring users to sign in.

That does not automatically mean these websites were leaking information. Some databases contain details meant to be publicly visible. However, researchers made additional read-only requests and found records containing email addresses across 7,403 websites.

Among the more serious cases, a service provider reportedly exposed more than 1,000 identity records containing passport numbers, nationalities and expiration dates. Other applications left customer payment information, phone numbers, postal addresses and ticket codes accessible.

The researchers also found exposed contracts, invoices, personal photo albums and internal WhatsApp communications. Such information could potentially be used for phishing, identity theft or ticket fraud. However, the investigation could not establish whether anyone had actually misused the exposed data.

The investigation highlights a growing concern around AI-powered coding platforms. Lovable promises users they can build applications without technical expertise, but protecting databases and managing access permissions still require careful attention.

Lovable reportedly told Handelsblatt that the problem was not limited to its platform and was widespread across the industry. Its terms also place responsibility for applications and data handling on customers.

Crissy Field cautioned that its findings should not be interpreted as a confirmed leak rate for all Lovable apps. The investigation covered a sample collected through Common Crawl, and researchers did not examine every application or download every database in full.

- Ends