{
  "id": 18023825,
  "title": "Lovable Data Leak 2026: 24,664 AI Apps Exposed 80,000+ User Records via Supabase",
  "url": "https://urgent.news/2026/11/03/lovable-data-leak-2026-24-664-ai-apps-exposed-80-000-user-records-via",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-03T21:46:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/yashvikothari/lovable-data-leak-2026-24664-ai-apps-exposed-80000-user-records-via-supabase-2l7a"
  },
  "original_language": "en",
  "account": "In November 2026, security researchers discovered that 24,664 AI-built web applications had inadvertently exposed over 80,000 user profiles. These apps, created using the Swedish startup Lovable, contained unencrypted passport numbers, payment details, and 200,000 private chat messages. The primary cause was the lack of Row Level Security (RLS) on Supabase, the open-source Firebase alternative used by Lovable. When RLS is disabled or misconfigured, attackers can easily access and query all data in a Supabase database. This incident illustrates the dangers of relying on AI code generation without proper security measures. To prevent such breaches, developers must enable RLS on all tables and set explicit access policies to ensure users can only access their own data. This story highlights the importance of understanding database security, even when using AI tools for application development.",
  "summary": "The $0 Security Breach: How 24,664 AI-Built Apps Leaked Your Passport Number A Cloud Security Analysis of the Lovable/Supabase Data Exposure The Hook In November 2026, security researchers scanned 159,041 AI-generated web applications. They didn't hack anything. They didn't use zero-days. They simply knocked on doors that were left wide open—and found 80,000+ user profiles, unencrypted passport…",
  "key_points": [
    "24,664 AI apps exposed user data in November 2026",
    "Unencrypted data included passport numbers and payment details",
    "Lack of Row Level Security caused database breach"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}