Should AI Write Your Code? Yes, If a Person Reviews It: What the Lovable App Leaks Show About AI-Generated Code

Researchers in Germany checked thousands of apps built with Lovable, an AI tool that writes whole web apps from a text prompt. They found many of those apps handing database records to anyone who asked, including identity document details and more than 200,000 private chat messages. If your business has built a customer portal, booking form or internal tool with an AI app builder, the same gap could be in your app right now, and under the platform's terms the app and its data are your responsibility.

So should AI write your code? Our view, said once: yes, AI can write code, but a person who understands it has to review it before it ships. The Lovable findings show why.

What researchers found in Lovable-built apps

Crissy Field GmbH, an application security firm in Hamburg, ran the investigation with the German business newspaper Handelsblatt. Their report says:

• They analyzed 159,041 Lovable projects between December 2025 and September 2026, found through public Common Crawl data.
• 34,545 of those projects used Supabase, the hosted database service the researchers believe is the most common one behind Lovable apps.
• 24,664 websites sent Supabase database records to the browser as soon as the page loaded, with no login and no clicks.
• On 7,403 of those 24,664 sites (30%), records containing email addresses showed up, across 10,560 tables.
• One service provider exposed more than 1,000 records with identity document details, including passport numbers, expiry dates and nationalities.
• A German lifestyle forum exposed more than 200,000 chat messages and more than 80,000 profiles.

Other exposed data included ticket and food sales records, contracts and invoices, AI-generated summaries of internal emails, personal photo albums and internal WhatsApp messages. The researchers pulled only parts of the data, using read-only requests with the same key the website itself used. They are not publishing details of how to reach it.

What is confirmed and what is not

Confirmed by the researchers' report: on the sites they examined, the data listed above could be read without logging in.

Not confirmed:

• Misuse. The researchers write that they "could not establish whether any of it had been misused." Nothing here shows that criminals took this data.
• A breach rate. The 30% figure covers only the 24,664 sites examined closely, and the report says it "should not be read as a confirmed data leak rate." The researchers also say their sample does not represent all Lovable apps. So it does not mean "30% of Lovable apps leak."
• Passport scans. Some coverage mentions scanned passports. The report describes identity document details such as passport numbers. It does not say images of passports were exposed.
• Lovable's response. The report says Handelsblatt contacted Lovable. It does not report a reply.

This happened before: CVE-2025-48757

This is not the first warning. Researcher Matt Palmer's published statement lays out two separate findings from 2025.

The showcase scan. On March 21, 2025, the team finished a scan of 1,645 apps from Lovable's "Lovable Launched" showcase. The scan looked only at homepages and found 303 exposed endpoints across 170 projects, about 10.3% of those checked. They emailed Lovable the same day.

The Linkable re-test. Before that scan existed, on March 20, 2025, Palmer first found the problem on Linkable, a Lovable-built site that made websites from LinkedIn profiles. When the team re-tested Linkable on May 24, 2025, the database handled logged-in requests correctly. But when they removed the authorization header, they got read and write access. They inserted a record with payment_status set to paid, getting around the site's Stripe payment step. That was one site, tested on its own, not a result of the showcase scan.

The issue was published as CVE-2025-48757 on May 30, 2025, rated 9.3 (Critical). The CVE record describes insufficient row level security in Lovable through April 15, 2025, letting attackers with no login read or write the database tables of generated sites. The record also notes that Lovable disputes the issue, saying each customer is responsible for protecting its own application's data.

What went wrong: row level security, explained

Apps like these talk to their database straight from the visitor's browser. That is normal for Supabase, and the key the browser uses is not meant to be secret. What protects the data is row level security (RLS): database rules that decide which rows each visitor may read or change.

Supabase's own documentation says to "enable RLS on every table in an exposed schema," and warns that a table without it "is readable and writable by any role with a grant on it." Skip that step, or write rules that only cover logged-in users, and the app looks fine in a demo while the database answers anyone.

This is an easy mistake for AI tools to make. Pages load, forms submit, the demo looks good. Missing access control stays invisible until someone tests the app from the outside, and that outside test is what a human reviewer is for.

Is AI-generated code safe?

It can be as safe as any other code, once someone checks it. In these cases the problem was not that an AI wrote the code. The problem was that nobody looked at the database permissions before real people's data went in.

Lovable's own terms (updated August 28, 2026) say the same thing. They state that "AI Output may contain errors, inaccuracies, or other issues and should not be relied upon without independent review," and that "You are responsible for your Customer Data and for the applications and projects you build, deploy, and make available." So if an AI-built app leaks, the platform's terms put that on the customer.

Why this matters for a business

• The customer data is yours to protect. If a booking form or portal exposes names, emails or ID numbers, the notification duties, legal exposure and damage to your reputation fall on your company, not on the tool.
• Payment logic can be bypassed. The Linkable re-test showed that when a database accepts writes from strangers, someone can mark an order as paid.
• Apps multiply quietly. AI builders let marketing, sales or operations staff ship a tool in an afternoon without IT knowing it exists. Every one of those tools is a database on the internet.

We cover the longer-term side in AI Can Build Your App. Who Is Going to Keep It Running? and The Gap in App Development Nobody Wants to Talk About.

What to do this week

AI code review questions people are asking

Should AI write code for my business?

It can save real time. Treat its output like work from a fast new hire: useful, but reviewed by someone who knows what to look for before it ships.

Is AI-generated code safe?

Not by default. It is as safe as the review it gets. The Lovable findings show apps that worked fine while their databases sat open.

Was the Lovable app data stolen?

That has not been shown. The researchers say they could not establish whether any of the data was misused.

Was Lovable itself hacked?

The report is about data exposed by apps that customers built. It does not describe a break-in at Lovable.

What is CVE-2025-48757?

A Critical (9.3) record, published May 30, 2025, for insufficient row level security in Lovable-generated apps through April 15, 2025. Lovable disputes it.

Who is responsible if an AI-built app leaks data?

Under Lovable's terms, the customer who builds and deploys the app.

What are the biggest AI coding risks?

Missing access control, payment logic the browser can change, and apps nobody owns after launch.

The bigger lesson

The tools that write code are getting better fast. What they cannot do is take responsibility for what they ship. That stays with a person, and the cheapest time for that person to look is before customer data goes in. The same rule applies to apps on your own servers, which is what our self-hosting infrastructure work is built around.

Want someone to review your AI-built apps? See security hardening or get a quote.

Get security alerts by email, with the free checklist, at security alerts.

Sources: Crissy Field: Lovable research; Matt Palmer: Statement on CVE-2025-48757; CVE record CVE-2025-48757; Lovable Terms; Supabase: Row Level Security.