Lovable app scan finds exposed database records

Crissy Field analyzed 159,041 Lovable projects found in Common Crawl datasets spanning December 2025 to September 2026.[1] Lovable, a Swedish AI startup founded in Stockholm in 2023, turns plain-language descriptions into web applications and is designed for people with little or no programming experience.[1] The analysis focused on Supabase, a database service, and found that 34,545 of the projects examined used it.[1] Handelsblatt reported that Lovable said more than 50 million projects had been completed, with 1.2 million added weekly.[2]

Crissy Field found 24,664 websites that sent Supabase database records when pages loaded, without requiring a login or other interaction.[1] It cautioned that this behavior alone is not necessarily a security issue, because the records might be intended for public display.[1] The investigation found email-containing records in 10,560 tables across 7,403 websites.[1] Examples included a German lifestyle forum with more than 80,000 profiles containing full names, email addresses, birth dates and gender information, as well as more than 200,000 chat messages.[1]

The 7,403 websites represented 30% of the 24,664 websites examined more closely, but Crissy Field said that figure should not be treated as a confirmed data-leak rate.[1] It said the Common Crawl sample was not representative of all Lovable applications and that it retrieved only parts of the datasets rather than downloading them in full.[1] The inspected records included email addresses, phone numbers, postal addresses, payment information and ticket codes.[1] Crissy Field said it could not establish whether any exposed data had been misused.[1]

Other examples included more than 1,000 identity records at one service provider, containing passport numbers, expiration dates and nationalities; contracts, invoices, personal photo albums and internal WhatsApp communications were also among the exposed material.[1] In one case, 280,000 emails sent to a provider’s customers were accessible.[1] Crissy Field said exposed information could be used for phishing, ticket fraud or identity theft, and that recurring database-integration patterns could help attackers find similar misconfigurations across applications.[1] It said Lovable’s terms place responsibility for applications and data handling on customers.[1]