Crissy Field scanned 159,041 Lovable projects and found thousands exposing private database rows to any remote visitor without a login, per its research report.
The fault is not a single bug.
Lovable is a Swedish startup that turns plain language prompts into web applications complete with login and database code. Supabase is an open source backend that gives each app a Postgres database reachable through an API key shipped in the browser. A user describes an app, Lovable wires that key into the frontend, and the browser then asks Supabase directly for rows when the page loads.
Common Crawl is an open archive of the public web that Crissy Field used to find Lovable sites built from December 2025 to September 2026. Of that set, 34,545 used Supabase, according to Crissy Field. Of those, 24,664 returned database records on first load with no login, and further read-only requests pulled email addresses from 10,560 tables across 7,403 sites, or 30% of the closer sample, according to the same analysis. Crissy Field cautions that 30% is not a confirmed leak rate because some emails may be public contacts or test data while other personal records contain no email at all.
The concrete cases are stark. A German lifestyle forum exposed more than 80,000 profiles with names, emails, birth dates and gender plus more than 200,000 chat messages, according to Crissy Field. Event organizers and restaurants exposed tens of thousands of ticket and food sale records with phones, addresses, payment details and ticket codes. A property manager exposed AI summaries of internal emails, while a service provider exposed more than 1,000 identity records with passport numbers, expiration dates and nationalities. Other open sets held tens of thousands of contracts, invoices, photo albums and WhatsApp threads, including 280,000 customer emails from one provider.
Row Level Security is Postgres rules that decide which rows each web key is allowed to read. Lovable integrations follow recurring code patterns, so a missing rule in one app often means the same missing rule in many apps, according to Crissy Field. Lovable markets building without technical knowledge but its terms place responsibility for apps and data handling on customers. Separate reporting by Tech Bytes noted API tokens were also among the exposed secrets, which would let an attacker reuse access elsewhere.
If you run a Lovable app with real customer data, assume its tables are public until a qualified review proves otherwise and recheck after every major change.
