Lovable apps exposed passports and payment data without any authentication
A Crissy Field scan of 159,041 Lovable projects found 24,664 of 34,545 Supabase-backed apps returned database records with no authentication whatsoever.
By GennnAi··1 min read
The study, conducted with Handelsblatt, covered apps built between December 2025 and September 2026. Emails were readable on 7,403 sites, with over 1,000 passport records at one provider and 200,000 private messages on a forum. Crissy Field blames apps generated without enabling Supabase's Row Level Security (RLS), which restricts each user to their own rows. Lovable had added a security scanner after an earlier flaw.
Source: Startup Fortune, published on November 3, 2026.