Is Lovable Safe? Exposed Apps Leaked Passport Numbers and 200,000 Chat Messages, What Lovable Leaves to You, and What to Check This Week

Some apps built with Lovable, the AI app builder, were found giving customer records, including passport numbers and more than 200,000 chat messages, to anyone who asked their databases directly. If your business runs a Lovable app or is about to launch one, the honest answer to "is Lovable safe" is yes, as long as someone checks the database permissions that the platform leaves to you.

What researchers found in Lovable apps

The research comes from Crissy Field, an application security firm in Hamburg, working with the German business paper Handelsblatt. The team used public Common Crawl web data to find 159,041 Lovable projects seen between December 2025 and September 2026. They focused on Supabase, the hosted database they believe most Lovable projects use.

The examples in the report:

• A German lifestyle forum: more than 80,000 profiles with names, email addresses, dates of birth and gender, plus more than 200,000 chat messages.
• Event organizers and restaurants: tens of thousands of ticket and food sale records, including email addresses, phone numbers, postal addresses, payment information and ticket codes.
• A service provider: more than 1,000 records with identity document details, including passport numbers, expiration dates and nationalities.
• A property management company: AI-generated summaries of internal emails with sensitive details about tenants, owners and business partners.
• Others: contracts and invoices, personal photo albums, internal WhatsApp messages, waiting lists, support requests and 280,000 emails a provider had sent to its customers.

What is confirmed and what is not

Confirmed: the researchers retrieved these records themselves using only the public key each app already sends to every visitor's browser. No login was needed.

Not confirmed: whether anyone misused the data. The researchers say plainly: "We could not establish whether any of it had been misused."

Not a breach rate: the 30% figure is not a confirmed leak rate. The researchers note that some email addresses may be public contacts or test data, that records without email addresses were missed, and that their sample does not represent all Lovable apps. They also retrieved only parts of each dataset, so the real amount of exposed data may be larger.

Not known: the report does not name the affected apps, does not say whether they have been fixed, and does not describe a response from Lovable. Handelsblatt contacted Lovable about the findings. The report describes data exposed by individual customer apps, not a break-in at Lovable itself.

Lovable CVE-2025-48757: this has happened before

This is not a new kind of problem. In March 2025, researcher Matt Palmer reported that Lovable-generated apps had missing database access rules. His timeline gives discovery as March 20, 2025, the report to Lovable on March 21, and public disclosure on May 29, 2025. The CVE record, published May 30, 2025, describes "an insufficient database Row-Level Security policy in Lovable through 2025-04-15" that let remote attackers with no login read or write database tables. It carries a CVSS 3.1 score of 9.3, rated critical.

The record is tagged "disputed": Lovable's position is that each customer is responsible for protecting its own app's data. Palmer reported exposed names, email addresses, API keys for third-party services, and payment records, including the ability to change payment status.

Why Lovable apps leak: Supabase row level security explained

A Lovable app's web page talks to Supabase directly from the visitor's browser. That means the public key is visible to everyone, which is normal. What protects the data is row level security (RLS): rules inside the database that decide which rows each person may read or change.

Supabase's own guidance is direct: "Enable RLS on every table in an exposed schema." Without it, a table is "readable and writable by any role with a grant on it," and on many projects that includes visitors who are not logged in. Supabase also warns that once RLS is on, no data comes through the public key until you write policies, so turning it on without testing can break your app. Both steps matter: switch it on, then write rules that let each user see only their own records.

What Lovable does well

Lovable has built real safeguards, and it is fair to say so:

• Quick scan runs automatically when you publish. It checks database access rules, including RLS, known flaws in dependencies, and MCP servers exposed without authentication.
• Deep scan reviews your app's code for access control, unsafe input, leaked secrets, payments and authentication issues. You run it on demand.
• Block publishing with critical issues is a setting workspace admins can turn on.
• API key protection spots keys pasted into chat and moves them into Secrets.

Lovable is also clear about the limits: "These tools help identify common security issues, but they cannot guarantee complete security."

What Lovable leaves to you

Lovable's terms, last updated August 28, 2026, say: "You are responsible for your Customer Data and for the applications and projects you build, deploy, and make available." On AI-generated code: "You are solely responsible for reviewing, validating, and using any AI Output," which "should not be relied upon without independent review and testing." Its security documentation adds: "You are responsible for ensuring that your app meets the security requirements appropriate for its use case."

For a business, that settles it. If your booking app, client portal or order form exposes customer records, the people affected are your customers and the conversation is yours to have. Our view, said once: AI can write the code, but a human has to review it before it ships.

Is Lovable safe for business? What to check this week

If the app handles identity documents, payments or health details, get a professional security review before real customers use it. Lovable recommends the same.

Lovable security questions people are asking

Is Lovable safe to use?

Yes for building and prototyping. For an app holding customer data, it is safe only after someone confirms the database rules, tests access as an outsider and reviews the generated code.

Was Lovable hacked?

The report describes individual customer apps whose own database settings let anyone read records. It does not report a break-in at Lovable, and it does not confirm the data was misused.

What is CVE-2025-48757?

A CVE published May 30, 2025, covering missing Supabase row level security in Lovable-built apps through April 15, 2025. Lovable disputes it, saying customers are responsible for their apps' data.

What is row level security in Supabase?

Database rules that decide which rows each user can read or change. Supabase says to enable it on every table in an exposed schema.

Does the Lovable security scan make my app safe?

It catches common problems, and that helps. Lovable itself says the tools cannot guarantee complete security.

Should I move my Lovable app to my own servers?

Moving hosting gives you more control, but it does not fix permissions. The database rules still have to be right wherever the app runs. See our self-hosting infrastructure page if ownership matters to you.

The bigger lesson

Tools that make building easy do not make checking optional. The data exposed in this research was not stolen through a clever attack: it was handed over because nobody confirmed who was allowed to read it. Whatever builds your app, a person needs to check its permissions before launch and after every major change.

Want a second pair of eyes on your app? See our security hardening work or request a free quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: Crissy Field research on Lovable; Lovable Terms; Lovable security documentation; Supabase row level security guide; Matt Palmer, CVE-2025-48757; CVE record CVE-2025-48757.