Lovable apps expose passport details and more than 200K private messages

Hi, I’m the author of this blog post. I submitted it to HN two weeks ago, but it didn’t gain much traction, so I’m glad to see it resubmitted. Happy to answer any questions, though I think the situation is fairly self-explanatory.

One of the golden rule of webdev is "never build your own auth" for a reason.

To me, it feels like Lovable is an irresponsible product selling the idea that web development is trivial now with LLMs, where the reality is that although it's true that agentic coding means while anybody can spin up a website in like 10 minutes, a professional software engineer who knows what they are doing can still utilize LLMs much more effectively than an amateur ever could.

One might argue that data breaches been there way before AI, the difference with these AI generated apps is:

- They are an easy target, they don’t need any sophisticated hacking knowledge (article mentions inspecting network calls in browsers).

- There tons of those, and more created everyday. For the average user, they don’t know what they are using, or how risky it can be.

The part people are ignoring is Supabase's culpability in this matter: https://github.com/orgs/supabase/discussions/4547

This was supposedly fixed on October 30, but there are reports floating around that for existing projects, the defaults still apply.

Lovable deserves some heat for using this, but this was a choice that was made by Supabase many years ago to support making it easier to onboard potential customers, a deliberate tradeoff of less onboarding pain for less security.

Railway got hit by pretty much this a few days ago. Attacker likely used abliterated models, stolen keys, ~$740k in AI charges. If it happens to them, random Lovable apps are easy targets.

It's incredible how little understanding the average person has about data, privacy, and security.

Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license.

Seeing as this is reported by a German organisation about a Swedish company: has this been filed with the authorities under the GDPR? Any details on whether (national) data protection authorities have picked it up and warned the companies and people in violation?

makes me wonder if Retool’s governance focused message is valid

Folks are blaming AI, and that's certainly part of it (folks without knowledge and experience can now build polished apps, though there were still plenty of "WTF" security breaches before AI), but I feel like the only thing that can fix this are real, stiff liability consequences.

The defects listed in this report didn't require some complicated 0-day exploit chain - they were just sensitive data stored without any authentication at all, in a database that anyone with Internet access can view. In other words, it would be the equivalent of a company like Public Storage leaving all of its storage units with no locks on them at all.

Affected users should be able to sue for a lot in these basic security failures. And obviously for many of these small websites, the potential damages would quickly bankrupt the site owners, but that's the point. People would think a lot more carefully about how they protect sensitive data if there were real negative consequences for their failures.

I can't state my disdain enough for the rabid, careless advancement of AI, and all the bros that keep telling me to catch up or fall behind, while they are actively causing harm to the hundreds of thousands, or millions of users they have, without care or consideration.

Nearly two decades of experience learning how to build safe, performant software, to be replaced by this shit.

We don't care about people, our customers anymore. We actively harm them for profit. This is such a garbage industry now.

Nothing to see here and working as intended.

Imagine frontier abliterated models running at 2,400 TPS finding all these issues rapidly on web apps like this.

You are not ready security-wise when these models get faster. ("Formal verification" won't save you either)

[flagged]

[dead]