Researchers find Lovable apps exposed passport details and more than 200,000 private messages
A study of 159,041 Lovable projects found passport details and more than 200,000 private messages exposed in apps that used Supabase. The report says many sites sent database records without login and that email-address-containing tables appeared in 30% of the closer sample. It matters because no-code AI tools promise easy app creation while leaving database security to users, creating real privacy failures when access controls are missing.
Researchers using Common Crawl examined 159,041 Lovable projects between December 2025 and September 2026 and found serious data exposures in applications built on the platform. The study, conducted with Handelsblatt, identified passport details and more than 200,000 private messages in exposed records. Of the projects reviewed, 34,545 used Supabase, a database service often connected to Lovable apps. The researchers said many sites sent database records when they loaded, without requiring login or other interaction.
The data shows the problem is not limited to a few apps. Researchers found 24,664 websites sent Supabase database records as soon as they loaded. By making additional read-only requests, they retrieved more database content. Email addresses appeared in 10,560 tables across 7,403 of those 24,664 sites, or 30%. The researchers caution that the 30% figure is not a confirmed leak rate, because email addresses can be public or test data and some personal records may lack email addresses.
The finding sits at the seam of the no-code AI app boom and ordinary database security. Lovable turns plain-language descriptions into web apps, including user management and database connections, and markets itself to users with little programming experience. Its terms place responsibility for applications and data handling on customers, while Supabase row-level security and access controls remain the technical mechanism that keeps private rows private. When those controls are absent, private records become publicly readable.
The immediate risk falls on people whose data was stored in Lovable-built apps: passport details, messages and contact details can be harvested by anyone who knows where to look. The case shows the gap between marketing an all-in-one service and assigning security responsibility to customers. For companies and individuals using no-code tools, the operational lesson is that shipping an app is not the same as securing the database behind it.
Users of Lovable-built apps face exposure of passport details, messages and contact information. The findings show builders are responsible for database security under Lovable's terms, and missing access controls can make private records publicly readable.
Sources (1)
- [1]Lovable apps expose passport details and more than 200K private messages(https://www.crissyfield.de/research/lovable-en/)