Study: Many Apps Built With Lovable Expose Sensitive Data Without Login
Security researchers analysing 159,041 projects built on the Swedish AI platform Lovable found many cases where personal and confidential data was accessible without logging in. The exposed data included passport details and more than 200,000 chat messages.
Researchers at the German firm Crissyfield, working with the newspaper Handelsblatt, examined how well data is protected in applications built with Lovable. Lovable is a Swedish AI platform founded in Stockholm in 2023 that turns plain-language descriptions into web applications, including for users with little or no programming experience. The study shows that many such apps leave even highly sensitive information unprotected.
How the check was done
The researchers used data from the open web archive Common Crawl to analyse 159,041 Lovable projects from December 2025 to September 2026. Of these, 34,545 used the database service Supabase. A total of 24,664 websites sent Supabase records as soon as they loaded, with no login required. Through additional read-only requests, the team found records containing email addresses in 10,560 tables across 7,403 of those sites (30%).
The researchers stress that 30% is not a confirmed leak rate: email addresses may be public contacts or test data, and the sample is not representative of all Lovable apps. Datasets were only partly downloaded.
What was accessible
A German lifestyle forum exposed more than 80,000 profiles with full names, email addresses, dates of birth and gender, plus more than 200,000 chat messages. Event organizers and restaurants exposed tens of thousands of ticket and food-sales records containing emails, phone numbers, postal addresses, payment information and ticket codes. One service provider exposed more than 1,000 records with identity document details, including passport numbers, expiry dates and nationalities.
Also accessible were tens of thousands of contracts and invoices, personal photo albums, internal WhatsApp communications and, in one case, 280,000 emails sent to a provider's customers. The researchers could not establish whether any of the data had been misused.
Responsibility
Lovable's terms and conditions place responsibility for applications and data handling on its customers. The researchers recommend that experts review access permissions before an app handles real data, and repeat the review after significant changes. Handelsblatt contacted Lovable with the findings.