Crissy Field Study Finds 159,041 Lovable Apps Left Data Open Without Login

A Crissy Field study found 159,041 Lovable apps online between December 2025 and September 2026, with 10,560 tables on 7,403 websites exposing records that include email addresses, passport numbers and chat messages. Trending Topics published the findings, which were produced with Handelsblatt.

What Crissy Field Found in Lovable Projects

Crissy Field, a German security company, identified the projects through the open web archive Common Crawl. Of the 159,041 Lovable projects, 34,545 use the database service Supabase, and 24,664 of those sites sent database records while loading, without a login or further interaction. The researchers then sent read-only queries using the same API key the page already transmits and reached more content.

In 10,560 tables on 7,403 websites they found records with email addresses, equal to 30 percent of the more closely examined pages. Crissy Field said that share is not a confirmed leak rate, because email addresses can be public contact addresses or test data and the Common Crawl sample is not representative of all Lovable apps. The report's examples include a service provider that exposed more than 1,000 records with passport numbers, expiry dates and nationalities, and a German lifestyle forum that showed more than 80,000 profiles with full names, email addresses, birth dates and gender, plus more than 200,000 chat messages. Event organizers and restaurants made tens of thousands of orders with phone numbers, addresses, payment information and valid ticket codes accessible, and one provider's 280,000 customer emails were viewable. Crissy Field could not determine whether the data was misused and did not publish the affected apps or the exact access path.

No breach at Lovable or Supabase was needed. The key Supabase apps send in the browser is intentionally public, and data is protected only by database access rules known as Row Level Security. When those rules are missing or too permissive, anyone with the key can read the tables. Crissy Field said database connections in Lovable follow recurring patterns, so a misconfiguration found in one app can be used to search thousands of others for the same error. Lovable tells users they need no technical knowledge to build an app but assigns responsibility for security and privacy to customers in its terms, the researchers noted, adding that laypeople can hardly recognize such gaps.

Lovable told Cybernews it sees no vulnerability in its AI and described the matter as a known, industry-wide configuration problem with Supabase. UpGuard examined about 300,000 Supabase-connected domains and found readable tables on 16,326 databases, more than half with indications of personal data. Lovable offers a Security Scan and an AI security checker that review apps for such errors before publication; they were introduced after a similar gap in Lovable apps became public in 2025 under the identifier CVE-2025-48757.

Lovable's Funding and Revenue Scale

Lovable is a Stockholm-based AI application builder founded in 2023 that lets non-technical users generate, deploy and host full-stack web apps from natural-language prompts, according to akta.pro company records. The same records list a $400 million Series C in August 2026 led by EQT and Menlo Ventures, a $330 million Series B in December 2025 led by CapitalG and Menlo Ventures, a $200 million Series A in July 2025 led by Accel and a $15 million seed in February 2025 led by Creandum, for total funding of $952.5 million. The records show $500 million in annual recurring revenue as of June 2026, up from $400 million reported in February.

Earlier Lovable Security and Product Moves

On November 9, 2026, Lovable said it provides built-in security for app builders, including default secure sign-in, encrypted secrets and code scanning, flags issues such as overly open data access rules and offers auto-fix with a free deep scan, according to Lovable. The same day, Unite.AI reported that Lovable deployed Lovable Realtime, a service centralizing authorization that reached 2.06 million peak concurrent subscriptions and reduced permission recomputes by about 84 percent. On November 12, 2026, Business & Financial reported that Pledge launched a charitable giving connector on Lovable, letting any Lovable project accept donations to 2 million verified nonprofits.