Lovable Apps Exposed Passports and Payment Data, Study Finds

What the researchers found

Crissy Field examined about 159,041 projects built with Lovable. Of those, 34,545 used the Supabase database service, which is commonly paired with the platform. In 24,664 cases, websites sent database records as soon as a page loaded, without asking visitors to sign in.

That does not mean every one of those sites leaked private data, since some databases hold information meant to be public. Still, the researchers ran additional read-only requests and found records containing email addresses on 7,403 sites.

In one of the most serious cases, a service exposed more than 1,000 identity records with passport numbers, nationalities and expiry dates. Other apps left customer payment details, phone numbers, postal addresses and ticket codes open. Contracts, invoices, personal photo albums and internal WhatsApp conversations were also visible. Such data could be used for phishing, identity theft or ticket fraud, though the investigation could not show that anyone actually misused it.

Responses and caveats

Lovable told the business daily Handelsblatt that the problem is not limited to its platform but widespread across the app-building industry. Its terms of use make customers responsible for the apps they create and for how those apps handle data.

Crissy Field cautioned against treating the results as a confirmed leak rate for all Lovable apps. The sample was gathered through Common Crawl and does not cover every app on the platform, and the researchers did not download entire databases in every case.

The findings add to growing concern about AI-assisted coding tools: they lower the barrier to building software, but securing databases and managing access permissions still demands careful attention from whoever publishes the app.