Scan of 159,041 Lovable apps finds exposed passport data and 200,000+ chat messages

A large-scale security review of apps built with the AI app builder Lovable has found sensitive personal information — including passport numbers and more than 200,000 private chat messages — accessible to anyone without logging in. The findings come from an investigation by security researchers at Crissy Field, carried out together with the German newspaper Handelsblatt, which first reported the results on November 2, 2026. The published report contains a more recent analysis with updated figures.

What was scanned

Lovable is a Swedish startup, founded in Stockholm in 2023 by Anton Osika and Fabian Hedin, that turns plain-language descriptions into working web applications, including apps with user management and database connections. It grew out of Osika's open-source GPT Engineer project, was renamed in late 2024 and launched publicly that November.

Working from Common Crawl web-archive datasets covering December 2025 to September 2026, the researchers identified 159,041 Lovable projects, 34,545 of which used the database service Supabase. They focused on Supabase because its integration is comparatively easy to analyze and, in their assessment, it is the most widely used database among Lovable projects. Lovable's own database features, introduced in late 2025, were not examined, though the report says similar misconfigurations may occur there.

What the researchers found

Of the Supabase-backed projects, 24,664 websites delivered database records as soon as they loaded, with no login or interaction required. On its own that is not a security problem, the researchers note — the data may simply be intended for public display. But by issuing further read-only requests with the same API key, they were able to pull additional database content. In 10,560 tables across 7,403 of those 24,664 websites (30 percent), the retrieved records contained email addresses.

The report is careful about that 30 percent figure: emails may be public contact addresses or test data, while the method misses personal records that contain no email address at all. The two effects partly offset each other in ways the researchers could not quantify, so the number should not be read as a confirmed leak rate. The Common Crawl sample is also not representative of all Lovable apps, and only parts of each dataset were downloaded, meaning the true totals could be larger. Details of how the data was accessed were deliberately withheld.

Specific cases

Among the serious cases documented in the report:

• A German lifestyle forum exposed more than 80,000 profiles with full names, email addresses, dates of birth and gender, plus over 200,000 chat messages.
• A service provider exposed more than 1,000 records with identity document details, including passport numbers, expiration dates and nationalities — information the report flags as directly usable for identity theft.
• Several event organizers and restaurants exposed tens of thousands of ticket and food-sale records containing email addresses, phone numbers, postal addresses, payment information and ticket codes.
• A property management company exposed AI-generated summaries of internal emails containing sensitive information about tenants, property owners and business partners.
• Other accessible content included tens of thousands of contracts and invoices, personal photo albums, internal WhatsApp communications and, in one case, 280,000 emails sent to a provider's customers.

Depending on the contents, such data could enable phishing, ticket fraud or identity theft, the researchers write; they could not establish whether any of it had already been misused. Handelsblatt contacted Lovable with the findings.

Why these leaks cluster

Access-control mistakes can happen in any application, whether hand-written or AI-generated, the report acknowledges. But it identifies two factors that amplify the problem on Lovable. First, database integrations follow recurring patterns, so an approach that works against one app may work against many others with little extra effort. Second, Lovable's marketing stresses that no technical knowledge is needed to build projects — which can give the impression that the platform also handles security — while its terms and conditions place responsibility for applications and data handling on customers. Users drawn in by that ease of use are also the least equipped to spot or fix misconfigured permissions.

Why it matters

The scan is one of the clearest demonstrations yet of what happens when AI tools collapse the barrier to building software but not the responsibility for running it. Real people's passports, payment details and private conversations ended up readable by strangers, with direct harm potential through identity theft and fraud. The report's conclusion applies well beyond Lovable: an easy-to-use development platform is not a substitute for expert review of access permissions before an app handles confidential data, automated checks are no substitute for a professional security assessment, and those reviews need repeating after significant changes. As AI-generated applications multiply, that review step is the part the tooling cannot promise away.