Lovable apps expose passport details and more than 200K private messages

A Swedish AI startup called Lovable, founded in 2023 by Anton Osika and Fabian Hedin, has gained popularity for its ability to convert plain-language descriptions into web applications. However, a recent investigation has revealed significant privacy concerns regarding the platform's handling of sensitive information. Lovable's marketing emphasizes the ease of use, suggesting that technical expertise is not required to build projects, which may lead to the misconception that the platform takes care of security.

In fact, the company's Terms & Conditions place the responsibility for data handling on customers themselves. To explore the extent of the issue, researchers examined 159,041 Lovable projects, focusing on the database service Supabase due to its widespread use. From this sample, 24,664 websites sent database records without requiring login authentication.

This finding alone is not a security issue, as the data could be intended for public display. However, upon further analysis, researchers discovered that 30% of the 24,664 websites retrieved records containing email addresses, constituting 10,560 tables across 7,403 websites. These email addresses, while potentially public contact addresses or test data, could also serve as indicators of personal information.

The investigation uncovered numerous instances of exposed sensitive data, such as full names, email addresses, dates of birth, gender information, phone numbers, postal addresses, payment information, ticket codes, and more. In one particularly alarming case, a property management company exposed AI-generated summaries of internal emails that included sensitive information about tenants, property owners, and business partners.

Most concerning of all, a service provider exposed over 1,000 records containing identity document details, including passport numbers, expiration dates, and nationalities. Such highly sensitive information could potentially be exploited for identity theft. While the 30% email address figure should not be interpreted as a confirmed data leak rate, it serves as a stark reminder of the need for vigilance in handling sensitive data within AI-assisted web application development platforms like Lovable.