A German security firm says apps built with the AI app-maker Lovable exposed passport numbers, payment information and 200,000 chat messages to anyone on the internet, with no login required.
Security · AI app-building platform Lovable
AI-built apps left databases open to anyone on the internet
A German security firm reports that apps made with Lovable exposed passport numbers, payment information and about 200,000 chat messages, with no login required. The figures are as reported and have not been independently verified.
159,041
Lovable projects scanned
7,403
Sites with databases whose email addresses could be read
~200,000
Chat messages reportedly exposed
Scale of the exposure, drawn to proportion
Exposed sites as a share of projects scanned: about 4.7%, or roughly 1 in 21.
7,403
Sites with readable databases
Column heights are to scale. The orange column is 4.7% of the blue column.
How the exposure happens
A typical path from a generated app to public data.
1. Prompt
→
2. Generated app
→
3. No access controls
→
4. Public data
Open question
Who is responsible for security in AI-generated software?
App creators may assume the platform protects data by default.
Platforms may rely on users to configure access rules correctly.
Lovable's response and any remediation steps are not described in the available report.
Most directly concerned: app owners and anyone whose passport or payment details were exposed.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...