Security analysis finds sensitive data exposed in many Lovable-built apps

What the security analysis reports

A security analysis by Crissy Field GmbH, a Hamburg software firm, reports that many customer-built applications created with Lovable exposed personal and confidential data in their connected databases without a login. The English report page does not state a publication date. Crissy Field describes the work as a more recent analysis with updated figures after a Handelsblatt article by Lina Knees, dated 2 November 2026.

The researchers examined 159,041 Lovable projects created between December 2025 and September 2026. Of those, 34,545 used Supabase. In 24,664 of those projects, visiting the application website caused database records to be sent to the browser. The report says that alone is not a security issue: the data may be intended for public display. Email addresses appeared in 10,560 tables across 7,403 of those 24,664 websites, which the report presents as 30%. The authors warn that this 30% figure should not be read as a confirmed data leak rate: it applies only to the 24,664 websites they examined more closely, email addresses may also be public contact addresses or test data, and they retrieved only parts of the datasets. They also state that the sample is not representative of all Lovable projects.

The findings concern applications built by Lovable customers and how those apps were configured to use Supabase, not a reported compromise of Lovable's own systems. The report says Lovable's terms place responsibility for application security on the customer, and that the researchers did not examine Lovable's own database features introduced in late 2025.

What kinds of data the report describes

In the set of 24,664 websites, the report describes a German lifestyle forum with more than 80,000 user profiles and more than 200,000 chat messages, and a service provider with more than 1,000 identity-document records that included passport numbers, expiration dates, and nationalities. It also reports event and restaurant bookings with personal data, a property-management system, one case in which 280,000 emails sent to a provider's customers were accessible, and applications holding contracts or invoices, as the report states those examples. The authors could not establish whether any of the data had been misused.

Why this matters if you built or use a Lovable app

If you used Lovable with a connected database, the report is a reminder that a misconfigured customer-built app can expose records to anyone who loads the site. That is a configuration issue in apps built on the platform, not a finding that Lovable's own infrastructure was breached. Builders who store personal data should treat database access rules as their own security responsibility, as the report summarizes Lovable's terms.

What the report does not settle, including Lovable's response

The English report does not include a public statement from Lovable about these findings. It notes that Handelsblatt contacted Lovable. On 15 November 2026, Lovable's official blog and security pages did not contain a post that names this Crissy Field analysis or the Handelsblatt article. A 10 November 2026 Lovable blog post by Igor, Head of Security, describes general product security work and scanning; it does not mention this research and is not a reply to it. No official Lovable response was found in those primary sources.

This article does not describe how the researchers obtained access, and it does not give instructions for testing or reproducing the issue. The report also states that it is not publishing details of the access method.

Go a little further

Related reading

• Lovable profile →