Lovable AI apps exposed sensitive data in open databases

Researchers who scanned nearly 160,000 apps built with the Swedish AI coding platform Lovable AI found sensitive personal data sitting in databases that could be opened without even a basic login. The exposed material included passport numbers, private chat messages and payment details.

The cause appears to be unconfigured or missing Row Level Security rules in the backend databases behind the apps, not a hack of the Lovable platform itself. In other words, the apps were built and deployed without the access controls that would restrict who can read the stored data.

Some of the examples are specific. Event organizers and restaurants using Lovable-built apps let anyone read tens of thousands of orders and ticket sales, complete with emails, phone numbers, postal addresses, payment information and ticket codes. The report describes this as precisely the raw material for a scam at the door. A lifestyle forum built on the platform leaked more than 200,000 chat messages and 80,000 user profiles to anyone who asked.

The scale of the platform makes the findings significant. Lovable, founded in Stockholm in 2023, reports more than 50 million projects delivered and 1.2 million new ones each week. This week CEO Anton Osika told CNBC that AI was collapsing barriers to starting a business. The findings show a downside of that ease: people can launch apps that handle real customer data without the security configuration needed to protect it.