Lovable Data Leak 2026: 24,664 AI Apps Exposed 80,000+ User Records via Supabase
The $0 Security Breach: How 24,664 AI-Built Apps Leaked Your Passport Number A Cloud Security Analysis of the Lovable/Supabase Data Exposure The Hook In November 2026, security researchers scanned 159,041 AI-generated web applications. They didn't hack anything. They didn't use zero-days. They simply knocked on doors that were left wide open—and found 80,000+ user profiles, unencrypted passport…
In November 2026, security researchers discovered that 24,664 AI-built web applications had inadvertently exposed over 80,000 user profiles. These apps, created using the Swedish startup Lovable, contained unencrypted passport numbers, payment details, and 200,000 private chat messages. The primary cause was the lack of Row Level Security (RLS) on Supabase, the open-source Firebase alternative used by Lovable.
When RLS is disabled or misconfigured, attackers can easily access and query all data in a Supabase database. This incident illustrates the dangers of relying on AI code generation without proper security measures. To prevent such breaches, developers must enable RLS on all tables and set explicit access policies to ensure users can only access their own data.
This story highlights the importance of understanding database security, even when using AI tools for application development.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
