VULNpocalypse
MediumEcosystem changeMonitoring

Lovable AI apps: researchers report 7,403 sites exposed user data via Supabase

Crissy Field reports 7,403 Lovable-built sites exposed user data via Supabase misconfiguration; check Row Level Security on every table.

Published
Exploitation
No, not confirmed: the source reports only researcher read-only access and says there is no evidence of a breach of Lovable’s own infrastructure

What happened

German security firm Crissy Field reports that thousands of applications built with Lovable AI exposed user data. The data sat in Supabase databases that returned records without authentication, according to The420.in’s report on the research (The420.in). According to The420.in, the researchers blame missing or incorrectly configured access controls in individual apps, not a breach of Lovable AI itself.

According to The420.in, the research covered these points:

  • Scope: Crissy Field analysed 159,041 projects associated with Lovable AI, collected through the Common Crawl web archive.
  • Supabase apps: The researchers identified 34,545 Lovable applications that use Supabase.
  • Open databases: 24,664 of those applications returned database records without requiring authentication.
  • Email addresses: Using read-only requests, the researchers found email addresses accessible across 10,560 tables on 7,403 sites.

The researchers say they did not bypass authentication or exploit a vulnerability in Lovable AI. They say they used the same access mechanisms already available to ordinary visitors of the apps (The420.in).

The420.in reports that the exposed data in specific apps included:

  • more than 1,000 passport-related records at one service provider, including passport numbers, expiry dates and nationalities
  • email addresses, phone numbers, postal addresses, payment information and ticket codes in event booking, restaurant order and ticketing apps
  • more than 200,000 chat messages and approximately 80,000 user profiles on a lifestyle forum
  • contracts, invoices, photo collections and internal communications, with internal WhatsApp communications reportedly accessible in some apps
  • AI-generated summaries of internal emails about tenants, property owners and business partners at a property management company

The researchers attribute the exposure primarily to missing or incorrectly configured Supabase Row Level Security rules (The420.in).

According to The420.in, Lovable AI described the findings as part of a broader configuration problem affecting Supabase-backed apps, not a breach unique to Lovable. The outlet also cites separate research by UpGuard, which analysed around 300,000 domains showing signs of Supabase usage. UpGuard found 16,326 databases with externally readable tables, and more than half of those showed indications of personal information (The420.in).

These points are not confirmed:

  • The source does not name the affected apps.
  • No independent verification beyond the cited research is reported.
  • Whether any third party accessed the data maliciously is not confirmed.
  • The source does not mention a CVE.
  • The date of the scan is not confirmed.

The420.in states that the research does not show that attackers compromised Lovable AI’s infrastructure or a central Lovable database (The420.in).

Am I affected?

Based on the source, your app may be exposed if all of the following are true (The420.in):

  • You built and deployed an application with Lovable AI.
  • The application uses Supabase as its backend database.
  • One or more tables lack correctly configured Row Level Security, so unauthenticated visitors can query them directly.

The420.in says the UpGuard findings suggest insecure Supabase configuration can also affect apps built with traditional development methods. Supabase-backed apps built without Lovable may therefore have the same gap (The420.in).

What to do now

  1. Review the database access policies for every Supabase table your app uses. The420.in recommends this (The420.in).
  2. Ensure Row Level Security is enabled where appropriate, and check that its rules restrict which records each user can access (The420.in).
  3. Test whether an unauthenticated user can retrieve records that should remain private, using the same access an ordinary visitor of the app has (The420.in).
  4. Apply particularly strict controls to tables holding identity documents, payment data, private communications or contracts, as The420.in advises. Crissy Field separately says permissions need expert review before an app processes sensitive information (The420.in).

Sources