Lovable apps expose passport details and more than 200K private messages
Researchers examined 159,041 Lovable projects built between December 2025 and September 2026, 34,545 of which used Supabase. Many apps returned database records without requiring login, in some cases exposing passport details and over 200,000 private messages. The platform markets no-code building, but its terms place data-handling responsibility on customers.
What this means for indie developers：If you ship AI-generated or Supabase-backed apps, verify row-level security and anonymous access rules before launch, or user data may be publicly readable.
Read original → (Source: Hacker News · App Store/ASO)