Researchers find Lovable apps exposing passport data, 200,000+ messages and other sensitive records

An analysis of 159,041 Lovable projects found that 24,664 sent Supabase database records when pages loaded, and further read-only requests uncovered email addresses in tables on 7,403 of those sites. Exposed records included more than 80,000 user profiles, over 200,000 chat messages, passport details and customer emails; researchers could not determine whether the data had been misused. The 30% figure is not a confirmed leak rate, and the Common Crawl sample is not representative of all Lovable apps.

For teams building with Lovable, the findings support reviewing database access rules and user-data separation with a qualified security professional before using real customer or business data, and repeating checks after major changes. The analysis focused on Supabase, not Lovable’s newer built-in database, and does not establish how widespread the issue is across all apps or whether exposed records were exploited.