“Apps built with the AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone, no login needed. German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites. Lovable promises no coding skills are needed. Its terms make…”

The research report exists, is published by the named firm, and says substantially what the post says it says. On scale and method: using datasets from the open web archive Common Crawl, the researchers identified and analyzed 159,041 Lovable projects from December 2025 to September 2026, of which 34,545 used Supabase. 24,664 websites sent database records from Supabase as soon as they loaded, without requiring a login or any other interaction; the report notes that alone is not a security issue because the data may be intended for public display, but by making additional read-only requests the researchers retrieved more database content, finding records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites, or 30%. On the specific data types in the claim: a German lifestyle forum exposed more than 80,000 profiles containing full names, email addresses, dates of birth and gender information, and more than 200,000 chat messages were also accessible. Several event organizers and restaurants exposed tens of thousands of records relating to ticket and food sales with no login required, and the records inspected included email addresses, phone numbers, postal addresses, payment information and ticket codes. In what the report calls a particularly serious case, a service provider exposed more than 1,000 records containing identity document details, including passport numbers, expiration dates and nationalities. The report also describes numerous newsletter subscriptions, waiting lists and contact and support inquiries, including one case where 280,000 emails sent to a provider's customers were accessible, and states that such exposed data could be used for phishing, ticket fraud or identity theft, while the researchers could not establish whether any of it had been misused. On the marketing-versus-terms point the post makes: the report states that in its marketing Lovable repeatedly emphasizes that no technical knowledge is needed to build projects, which can give the impression that the platform takes care of security too, yet Lovable's Terms and Conditions place responsibility for applications and data handling on the customers themselves, leaving what the report calls a troubling gap. On Lovable's response: Handelsblatt reports that tens of thousands of websites built with the platform apparently have sensitive user data openly accessible, based on IT security experts' analyses provided exclusively to the paper, and that data thieves could have accessed sensitive Lovable user data through the gap for at least a year. Handelsblatt says it received tips about the security problem in mid-August, checked it, and confronted Lovable with it, and that further reporting shows the problem goes beyond this one provider. The paper's own framing of the company's answer is that, according to Lovable, this is an industry-wide problem. Important limitation stated by the researchers themselves: the approach misses personal records that contain no email address, these effects partly offset one another to an extent the researchers could not establish, and the 30% figure should therefore not be read as a confirmed data leak rate, applying only to the 24,664 websites examined more closely. The report also notes that Lovable's own database features, introduced in late 2025, are still less widely used, that similar misconfigurations may occur there too, and that they were not examined in this analysis. The report carries a note that it presents a more recent analysis and updated figures compared with the Handelsblatt article published on November 2, 2026. Background, consistent but separate: the same root cause was documented in 2025, when a vulnerability was recorded in deployed Lovable-generated projects due to default insufficient row level security policies on client-controlled direct database requests, and a crawl of 1,645 Lovable-powered projects found 303 insecure endpoints across 170 sites, or 10.3%. Lovable's current documentation says it sets up basic row level security policies automatically but that users should review and adjust them early in development.