24,664 Lovable Apps Answered Strangers With No Login

What The Scan Found

A property management firm asked an AI tool for an app that summarised its inbox, and the app it got published those summaries, tenant details included, to anyone who opened the right address. That firm is one of the cases German security company Crissy Field described this week after pulling 159,041 projects built on Lovable, the Stockholm vibe-coding platform, from the Common Crawl archive and asking each database what it would hand a stranger.

Event organisers and restaurants exposed orders and tickets with phone numbers, postal addresses, payment details and ticket codes. Other tables held contracts, invoices, photo albums and internal WhatsApp messages. The findings ran first in the German business daily Handelsblatt.

Nobody Broke In

None of this needed an attack, because the apps gave the data to every visitor by design. The researchers used read-only requests and the same public key each page hands to the browser. What was missing was Row Level Security, the Supabase setting that decides which rows a visitor may read, and without it the public key opens the whole table.

Lovable told the researchers it is dealing with a known, industry-wide configuration problem in how Supabase is used, and the numbers back that part. In September UpGuard tested about 300,000 domains showing signs of Supabase and found 16,326 databases with readable tables, more than half with signs of personal data. UpGuard said the common thread was that the sites were made by AI coding agents and the people running them did not know how they were configured.

Our read is that the security decision has moved. It used to sit with a developer who chose the database rules. It now sits with whoever typed the prompt, and both vendors say the configuration is the customer's job. Lovable reports more than 50 million projects built and 1.2 million new ones a week, so that is a lot of people holding a decision they don't know they made.

Why It Matters Under GDPR

The business that publishes an app decides why and how it handles the data, which makes it the controller under GDPR, whoever wrote the code. Lovable and Supabase supply the tools. A sales team that built a lead form, or an office manager who built a booking tool, has put the company's name on the database behind it.

An open table of personal data is a confidentiality problem the controller must assess. If it is likely to put people at risk, Article 33 gives 72 hours from becoming aware of it to tell the data protection authority, which in Britain means the ICO under the UK GDPR. The researchers only read what was offered to them. Whether anyone else did is a question only your own logs can answer, and many quick-built apps keep none worth the name.

What To Do This Week

Start with an inventory, because the apps most at risk are the ones IT never approved. Ask every team which tools they built with Lovable, Bolt, Replit or similar services and which of them collect customer or staff data.

For each one on Supabase, check that Row Level Security is switched on for every table that holds personal data, and that a policy limits each row to the people who should see it. Supabase's own security advisor flags tables without it. Hiding the public key does nothing, since it is meant to be public, and the protection has to come from the policies.

Then make a review a condition of going live for anything that touches customer data. Crissy Field put it plainly: an easy development platform does not remove the need for an expert review of access permissions before an app handles confidential data.

Read next: A Real Government Email Just Leaked Revolut's Data  |  Your License Photo Sat On Their Server For A Year