Reshare — content from Redouan Tayaa
In 2025, a security researcher found more than 170 applications built with Lovable whose databases were readable by anyone.
Not hacked. Just open.
Names, email addresses, phone numbers, payment statuses, and sometimes access keys to other services. All you had to know was where to look.
The cause was always the same. The database used by these apps lets you say, row by row, who has the right to read what. Except that setting was missing or badly done. And since the app worked perfectly, no one noticed.
That’s the trap with AI-built prototypes. A security flaw doesn’t show up on screen. The app works, the clients are happy, everything looks normal. Until the day someone else takes a look.
And I’m not saying this against Lovable, or against AI tools in general. They do exactly what they’re asked to do. The problem is that no one asked them to check this.
If you have an app built with a tool like this, and real clients are putting their data into it, ask someone who knows how to look: “can one user read another user’s data?”
It takes 1 hour to check. The day a client discovers it instead of you, it takes much longer to fix.
LinkedIn Sources
- Profile: Pierre Jean Duvivier aka Sage (LinkedIn)
- Shared author: Redouan Tayaa (LinkedIn)
The post In 2025, a security researcher found more than 170 applications built with Lovable whose databases were readable by anyone. appeared first on les plumes qui mordent.
Frequently Asked Questions
FAQs The 2025 Lovable Database Exposure Incident
1 What happened with Lovable in 2025
A security researcher discovered that more than 170 apps built with Lovable had databases that anyone on the internet could readno login or password required
2 What is Lovable
Lovable is an AIpowered tool that lets people build web apps by describing what they want in plain language even without much coding experience
3 What does it mean that the databases were readable by anyone
It means the data behind those apps wasnt protected Anyone who found the database could view its contentslike user emails messages or order detailswithout needing permission
4 How did the researcher find these apps
The researcher scanned the internet for databases connected to Lovablebuilt apps that were left publicly accessible then verified they could be read without authentication
5 Was this a bug in Lovable itself
Its generally understood as a configuration problemapps were deployed with database access left openrather than a flaw in Lovables core code The exact cause depends on each apps setup
6 What kind of data was exposed
Reports indicated exposed data could include user information such as emails names and app content The specifics varied from app to app
7 Why does this matter to app owners
Anyones private data being visible can lead to privacy violations legal trouble under laws like GDPR loss of user trust and potential account takeovers
8 Why does this matter to everyday users
If you signed up for one of these apps your personal details may have been visible to strangers Watch for phishing emails and reuse of your password on other sites
9 What is a database in simple terms
Its the place where an app stores its informationlike a digital filing cabinet for user accounts posts and orders
10 What does authentication mean here
It means proving who you are before being allowed to see or change data These databases skipped that check entirely
11 What is RowLevel Security
RLS is a database feature that controls exactly which rows of data each user can see If its turned off everyone can see everything
