Security researchers find sensitive data exposure in apps built with Lovable
Thousands of applications created on the Lovable platform have inadvertently exposed sensitive user information, including passport numbers and private communications.
A security analysis has revealed that thousands of apps built using the Lovable development platform were found to be exposing sensitive user data. The research indicates that data ranging from passport numbers and financial records to private messages was left accessible due to configuration flaws.
Researchers audited over 2,700 apps created on the platform between August and September 2026. The findings suggested that nearly 50% of the tested applications contained security vulnerabilities, often stemming from how the platform's AI-driven backend handled database permissions. In many cases, these configurations allowed unauthorized access to sensitive datasets without requiring authentication.
Lovable is part of the emerging "vibe coding" sector, which allows users to build software through natural language prompts. Security experts suggest that while AI development tools significantly lower the barrier to entry, they can inadvertently encourage developers to overlook fundamental security protocols. As of now, the company faces scrutiny over whether its default settings provide adequate safeguards for user data.