Lovable-built apps expose payment details, passport data and 200,000 chats online

Researchers at the German security firm Crissy Field have found that apps built with Lovable, a Swedish AI startup, leave sensitive user data open to anyone, with no login required. They examined 159,041 projects created on the platform and found several cases where data could be accessed without credentials.

The exposed information included passport details, payment data and personal records. More than 200,000 chat messages were also accessible. The report does not say how many of the projects were affected, and it does not name the specific apps involved.

The researchers found no evidence confirming whether the exposed data had been misused, so it is unknown whether anyone other than the researchers accessed it.

The findings matter because Lovable lets people build apps with AI, and the projects reviewed were built on that platform. Documents like passports and payment details are the kind of data that can enable identity fraud and financial theft if they fall into the wrong hands. The result points to access controls missing from apps created on the platform, leaving users of those apps exposed. The report was published by Newsbytes on 3 November 2026 and gives no response from Lovable.