Imagine frontier abliterated models running at 2,400 TPS finding all these issues rapidly on web apps like this.

You are not ready security-wise when these models get faster. ("Formal verification" won't save you either)

Formal verification doesn't solve all the problems, but alongside concerns like correctness, restrained surface area, supply chain awareness, treating PII as toxic waste to avoid rathee than treasure to collect can leave projects/orgs in a much better place than they let themselves get too.

Long way to go from here though.

On the one hand, that’s kind of encouraging. On the other, it feels like the unskippable “don’t copy this movie” warning on a legally purchased DVD -- the one that gets removed from pirated versions.

It seems to punish the wrong people.

Nearly two decades of experience learning how to build safe, performant software, to be replaced by this shit.

We don't care about people, our customers anymore. We actively harm them for profit. This is such a garbage industry now.

Probably the people who are victims of identity theft, or have personal DMs leaked, or any other severe consequence of data breaches?

Thanks for proving my point though. No one cares about them anymore, as long as we ship fast and stock go up.

It's just true.

[1] https://news.ycombinator.com/item?id=49105315

The old joke was "If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization", but in the AI era it feels like a butterfly would be enough.

I don't think you're making the counterpoint you mean to be.

Freedom from everything you enumerated already exists for anyone who cares enough to pursue it - robust ad and script blockers, operating systems with no coercion or user hostility, simple and stable scripting languages. They're not as polished as the products of manipulative and extractive abusers like Microsoft, Google, Apple, Discord, et al., and accordingly, users shun them, for the reason I explained above.

Ah, there's the victim blaming.

> Freedom from everything you enumerated already exists for anyone who cares enough to pursue it

Do you have any idea how daily life is for non-technical people? It isn't reasonable in our society to expect everyone to switch to FOSS, and blaming 60 year olds for getting their identity stolen because they weren't using a Linux phone or rolling their own self hosted matrix chat server is such a cruel and unbelievably out of touch take.

That would never happen though, the victims would plea and fight too vigorously in defense of their own abusers.

Who should be blamed for the actions of corporations ultimately subject to the society-scale approval of their consumers? No amount of misbehavior, malice, negligence, or abuse from the company can alienate the modal user of their products, they've thoroughly demonstrated this too many times to count.

It's not the doddering elderly folks I blame the most, it's everyone younger than them, the folks who grew up with the technology, aware of every abuse by these companies, who refuse to change their behavior. The ones who know better. The ones who can explain to you in great detail all about the surveillance, the dark patterns, the emotional manipulation, the extractive commercial angle, and who all refuse to adjust their behavior anyway. It's a choice, and it's one they make on a continual basis.

And to answer your question, no, I don't have much of an idea how daily life is for non-technical people besides them voluntarily suffering abuse like theft of their time (advertisements), or voluntarily paying a bribe to avoid the abuse, for no real reason other than that they don't care enough about the abuse or the bribe to spend 5 minutes learning how avoid both for free for the rest of their life.

This is very clear. You're incredibly disconnected from how most people in society operate, their motives, and capacity.

And your malice and contempt is entirely misplaced.

malice /măl′ĭs/ noun

1. A desire to harm others or to see others suffer; extreme ill will or spite.

2. The intent to commit an unlawful act without justification or excuse.

3. An improper motive for an action, such as desire to cause injury to another.

None of the above apply to me. I don't want to harm or injure anyone, and I don't want anyone to suffer. Consumers choose suffering and choose to voluntarily accept harm and injury, and I wish they wouldn't.

But you can't force people to not harm themselves, it's something they have to choose for themselves. Anyone who's ever lived with or loved an alcoholic or drug addict understands this. The contempt isn't for the person, it's for the theft of the person's faculties. The response to the person being unwilling to change is frustration with their choices, not contempt for the human being.

That's the scorn the average person feels for user-hostile software that requires them to "learn" insipid facts that you think are important.

And we were allowed to? I raised so many tickets over time that had no real business impact beyond "this is a security risk" and nearly all of them I was allowed to adress.

Maybe that makes me some kind of tech-boomer, like people responding to me are implying, but I don't really give a shit.

The underlying problem is that quality isn't profitable. It goes beyond tech. The companies that cared about quality had their lunch eaten by the companies that chased razor-thin margins and produced disposable junk. I'm not sure what it is about AI that makes everyone forget what the world was like five years ago.

The rest, including me, are supposed to take up the slack with ridiculous deadlines and pressure. I don't have time anymore. I have to trust that my prompt and testing descriptions and harness will take care of it. And I have no clue whether that's truly happening, because I have another ticket before I get time to review, or send some swarm of test/probe agents at it. And right now I don't trust it. (Literally look at the parent article?)

I did have that time and capacity in the past. Maybe you didn't. But the landscape is, to me, objectively different now.

We're on the same page about most of this, but my perspective differs in a couple of ways: - I have worked at companies that didn't prioritize quality and had unreasonable deadlines for most of my career. It's the default state of corporations with leverage over their workers. - This was getting worse before AI. Big tech was the anomaly in terms of pay, perks, benefits, etc, and they were already jointly deciding not to do that anymore around the time of Musk's Twitter layoffs. The main reason they had offered such a compelling environment was to prevent talented people from being hired by their competition, in which case they were perfectly happy to let them "play around" and focus on quality.

I find it frustrating when people imply that employment was an idyllic wonderland before AI ruined everything. AI is another step, potentially the final step, in boiling the middle class. It didn't invent poor working conditions, it brought tech workers down closer to everyone else's level.

The best move right now is to move to a small startup or start something on your own. I fully understand that this is easier said than done, when you have bills to pay and deadlines keep you too exhausted to escape. To some extent, that's probably part of why the deadlines exist.

Now you'll be at least 50% slower and likely fired if you care, because caring means understanding the code.

Have you ever considered that the people who are pro-AI are not a monolith, and that it can be simultaneously true that you should absolutely be learning how to effectively and safely use LLMs in engineering workflows, while it is simultaneously true that there are people who are using them very unsafely?

Beig opposed to learning AI as a whole because some people use it recklessly is like being opposed to learning AWS in 2015 because some people left sensitive data in open S3 buckets.

Do not confuse negligent misuse of the tool for the value proposition of the tool itself.

I'm furious about slop-shovelling profit-driven development that actively causes harm to people. And the lack of care for, or outright disdain of customers, specifically fuelled by a misuse of AI, and the people telling me to get used to this, the people telling me to stop reading my own PRs, the people telling me this is just how it is now. When we all know that isn't true.

I just don't see any grassroots movement advocating for responsible software development winning out with a demographic that can't even unionize for their own self benefit.

Only counterpoint is we have very well functioning unions in Norway for engineers.

But yeah, I don't see grassroots movements winning anywhere. Not even here.

https://en.wikipedia.org/wiki/Norwegian_Society_of_Engineers...

https://en.wikipedia.org/wiki/Tekna_(Norway)

Interesting times.

Regarding losing jobs - what I hope will keep me employed: opiniated creativity and common sense. Not sure if I'm right.

We don't have an option. Which is why a lack of care for users is abhorrent.

And this whole thread is just proving my point by blaming people and customers for the mistakes of technology companies.

If it were only used for prototypes and blogs, who cares. But it's being used by _real businesses_ that don't give a shit about security.

For all other services: is it really necessary to give them your passport info on the internet ?

I strongly believe that when used properly, AI can remove a lot of overhead that comes with writing the code (from both a critical thinking standpoint and physically it actually takes a lot more time than people realize to manually type code). You can focus on the design and have your team much more integrated in the designs and specifications of things without it being a slog to document the damn thing.

If I can go off and write up a draft and get feedback from my team in a day instead of in a week, I think that's fine. We can collectively walk through and use everyone's domain knowledge to correct details. Once everyone is onboard with the spec, I can feed that into a model to progressively do small changes rapidly but in such a way that's still manageable and reviewable for myself and the rest of my team.

If I go off and merge 45000 lines of code into main: fucking fire me and my whole team that approved that.

As with all new things that have extreme views on either side (AI is complete shit versus AI is the second coming of Christ in this case), there's generally a middle ground in between that we can collectively correct toward.

So the very company you're (possibly) using to "remove a lot of the overhead" is doing what you think is fireable! That's the irony!

¹https://www.anthropic.com/research/redesigning-source-contro...

I suspect for their public facing products (i.e., the claude ecosystem, which is like four products), the review process is much more rigorous, and the PRs merged in per day is likely much much lower.

A few things about their post: they're doing trunk development on a mono-repo. With their tool, Antique, instead of having branches, they just merge in stacks of commits, which they call "Change Requests". I have to wonder if their engineers have the models running and don't even realize the models are putting up a change request and if that's contributing to the high number.

Additionally, I would guess that a lot of the code merged into that mono repo is for experimental projects or other internal tooling that is in prototyping stage.

- They are an easy target, they don’t need any sophisticated hacking knowledge (article mentions inspecting network calls in browsers).

- There tons of those, and more created everyday. For the average user, they don’t know what they are using, or how risky it can be.

The initial idea behind the analysis was to start with the most basic setup and then move on to more sophisticated attacks. We never reached that second part, as so much sensitive data was already out in the open.

  Using datasets from the open web archive Common Crawl,
  we identified and analyzed 159,041 Lovable projects from
  December 2025 to September 2026. Of these, 34,545 used
  Supabase.
  
  24,664 websites sent database records from Supabase as
  soon as they loaded, without requiring a login or any
  other interaction. That alone is not a security issue:
  the data may be intended for public display. But by
  making additional read-only requests, we were able to
  retrieve more database content. We found records
  containing email addresses in 10,560 tables across 7,403
  of the 24,664 websites (30%).

Supabase tables also use pagination, and we never downloaded more than the first page.

The way I read it, the parent is trying to warn them that it may be dangerous for them to do it this way, because they may get sued.

And then the good people of HN find it sad (I agree with that feeling) and therefore attack the messenger (the parent), who simply defends their opinion. Which to me sounds like an informed opinion: "be careful next time about this", in a way.

That said, there were good arguments that I fully agree with.

It looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.

This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.

I have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.

I would like to know from the OP if they consider it harassment.

The way I read it, they mention that sadly, it is tricky to do security research without breaking the law, and breaking the law is bad for the security researcher. So I read that as an advice.

Most of the messages then are answers to the good people of HN who do not want to hear the advice, because it is sad and they don't want to accept that reality is sad? So the parent is defending their opinion against people saying "bullshit, finding a security vulnerability is a good thing, I'm absolutely sure that they would never be sued for it, because I don't want to live in a world where they would". Turns out, security researchers being sued it not unheard of.

"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"

You can't know that without pulling the data.

POC -> fine

Actual mass exfiltration -> not fine.

https://gdpr-info.eu/art-4-gdpr/ section 12.

Under the GDPR this was a breach, pure and simple.

One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.

Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.

The GDPR does not have a 'legitimate interest' category that includes exploiting breaches.

These are all separate code bases with different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)

If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.

Indeed, it would look a lot worse if you had.

my second guess was meth, third strict Constitution AIst

This is beyond silly.

There must be a limit to this.... trajectory.

oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."

I hope at least that that was a local model. If not you've made things considerably worse.

All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF.

I respect your insistence on proper data handling—you’re right to expect it—and we tried to be as careful as possible when conducting the analysis. Now let’s hold Lovable to the same standard.

I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).

Nothing neathack did was illegal, taking it at face value, of course.

Furthermore, he disclosed it responsibly, didn't publish any confidential data, or actually no data at all, other than a statistic.

Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.

Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.

I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue.

As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem.

Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair.

FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.

This is not a self-evident argument, what are you basing this on?

Problem scope is part of problem definition. If you dont know the scope, you dont know the problem.

"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."

You can't do that without downloading the data first.

I'm really more than a little bit surprised that people here don't seem to know the difference between reporting a vulnerability, which has the potential of being exploited and actually exploiting it.

This phrase is doing a lot of lifting here. Op clearly downloaded far less than is possible.

> Do you realize that at that point in time there is a breach?

As others have said elsewhere, this is a legal opinion and IANAL. Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.

> Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.

How will you prove you didn't read it?

How will you prove you deleted it and that you did not make a copy?

The company has no option: it is now documented that there is a breach. They will have to report that breach (which if I were them I'd be doing immediately, they have 48 hours to do so). And then they are going to have to make a tough decision: thank you for your time and effort and hope that you really didn't read it and that you didn't copy it or play it safe and file a case against you.

Lots of companies are going to play it safe, if only because their compliance department is not going to want to take the risk of you popping up a few months later with another interesting analysis of data that you shouldn't have had in the first place. That's what makes this so risky, it turns a clear 'good deed' into something that could well end up in court. Morality rarely factors into such situations.

It seems far more likely that Lovable and Supabase won’t consider or report this as a breach, nor will they take any action against the reporter.

I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.

Courts, especially in Germany, are typically not pleased if you take possession of the data.

For instance:

https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

And quite a few others besides.

As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.

To be fair, I don’t know for certain whether they will.

However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.

I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.

That said, I think that OP didn't cross the line in relation to each company, but IANAL.

Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

Put another way, since it's been put on Common Crawl, which presumably follows rules about what to scrape, hasn't Lovable effectively published this data?

> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.

There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.

The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.

And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.

Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.

(Copied from another comment of mine.)

IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.

He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.

Isn't this what you're getting at jacquesm?

You seem to be confusing what feels intuitively wrong with what is actually unlawful. Law doesn't work on feelings. Where are the terms of use? Do they explicitly prohibit this kind of access? How do they define it?

If a website publishes data and provides a public key that automatically allows a browser to retrieve it, without credentials or bypassing authentication, good luck arguing that security was actually bypassed.

Also, OP mentions confidential information. That doesn't automatically make neathack liable. If I publish someone's medical records in a publicly accessible comment here, are you liable for reading them, or am I liable for publishing them on a website with essentially no access controls?

>an actual leak

Got a link? Or "just trust me, bro"?

>I would bet a sizeable amount of money

Unfortunately, my religion prohibits gambling, which we consider degenerate behavior. But by all means, keep the confidence. It would be even more impressive if it came with an actual legal argument.

He's one of the site's longest-standing users, but his arguments aren't making much sense. I'm sure he can do better, but he's too stubborn to let this go.

I wish this site were a little more relaxed.

"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information."

This to me is proof that you actually downloaded the data, you would not have been able to present the conclusions that you did.

Anyway, I wish you best of luck with this whole affair, you did a great job at identifying a vulnerability, and then you turned it into an actual data breach. I hope that lawyer is willing to sign off on you having destroyed the data because that might become a very important issue.

It was strictly necessary to show the extent of the problem, which will lead to less products leaving their users' data exposed.

It's true that it might lead to legal problems, but there's no doubt that they were morally in the right, and that it's the laws that might punish this that are wrong and harmful.

They downloaded data, didn't (probably) do anything bad with it, and warned everyone about the problem, while in all likelihood many criminals already took it and used it without telling anyone.

You can give people legal advice, but you can't argue that they did anything morally wrong.

What are you talking about? Which data? Is this data in the room with us right now?

Pen testers here must be diligent about having a signed contract, or it is way too easy to end up in jail.

Never forget Aaron Swartz. [1]

[1] https://en.wikipedia.org/wiki/United_States_v._Swartz

As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.

> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.

I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.

I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.

For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.

Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.

Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.

The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."

To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.

If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.

Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.

Even if the company ends up paying damages, it’s too late for the true victims.

This said, the reality you seem to describe about pentesting (if I use the word correctly) is very sad to me. I truly respect that security people would go out of their way to make absolutely certain they don't hurt the feeling of the vulnerable website owner so that they don't get sued.

Even after this disclosure I haven't seen any communication from lovable to me as a customer which is just outright disgusting.

If the real issue is with Supabase then it needs further investigation as several AI tools use Supabase as standard now, not to mention many opensource projects.

Even when you do get Supabase's RLS policies correct, Supabase still doesn't offer a way to rate limit these tables. i.e Even if the data is secure, an attacker can overwhelm the database instance with big query in a simple for-loop and it's a constant source of issues in the Supabase Discord. There's no server in between that can enforce any rate limits. The whole "query the database from the client" has so many security pitfalls.

There are many BAD databases, choosing the wrong one still makes the owner responsible.

To add some nuance: Supabase’s security controls aren’t the simplest to work with and have been a source of confusion -- and data exposure -- for years. But Lovable markets its product specifically to people who, it claims, don’t need that technical knowledge. That sets the expectation that Lovable will get Supabase access controls right.

Some of these leaked private data - how many? That is not specified as far as I can tell.

Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license.

You and I wouldn’t build applications naively that could lead to people dying. People who don’t understand what they’re building might.

People are vibe coding at your hospital. They’re vibe coding at your utility company. They’re vibe coding at your pharma lab. I’ve met these people. They’re smart. They have phds. I tell them about SSL.

And then they could do something else that might result in property damage. Not at all comparable to the danger of an unlicensed pilot.

Keeps it private from him and is very careful who she shares it with.

Buys something online from a website she had no idea was built on Lovable (doesn't even know what that is, why would she?).

He finds her address, knock knock.

Unlikely? Yes, at the individual level. But the odds that just one customer out of all the folks using the 4,000 websites estimated by this researcher to leak private information is in a situation where their address becoming public puts them at risk? Probably pretty high...

It's easy to shrug these situations off, especially when you're not affected. But if you had all of the information needed to steal your identity — including your fucking *Passport,* you might understand the severity of the consequences a bit more viscerally. And FFS, who the hell is using Lovable to build a website that does something serious enough to warrant collecting Passport information?

Keep in mind these no-code sites are proliferating at the very same time that LLMs are becoming incredibly effective at finding vulnerabilities — even Postgres delayed their latest release to focus on a backlog of serious bugs uncovered by an LLM (Opus?). sshhole.com is another example of an egregious bug in ssh being uncovered after years in the wild by LLMs. It's really a perfect storm…

I get the point you're trying to make, but computer security as a field has already a big problem with maximalist mindset, and it doesn't help in keeping systems of consequence people actually secure and people safe from danger.

(That doesn't mean I don't appreciate/envy the GDPR, as a US citizen.)

You can watch DIY channels on YouTube where homeowners explain their methods.

In particular, they are vibe-rehabbing entire homes.

The problem are product managers and engineers who build things like Lovable, that are not secure by design. Those products have no right to exist, but their alternatives could exist and let their users focus on what matters, instead of paying web development tax.

The plane analogy would be selling tickets to passengers. Who then don't need a pilot license to get somewhere.

When Equifax thing happened, there was basically no repercussions. And that’s the only data breach I recall being in the news cycle for more than a week. Everything else has just been a blip since then. Also as there were no real repercussions other than some fines, companies took it as a signal that nobody cares (rightfully).

The defects listed in this report didn't require some complicated 0-day exploit chain - they were just sensitive data stored without any authentication at all, in a database that anyone with Internet access can view. In other words, it would be the equivalent of a company like Public Storage leaving all of its storage units with no locks on them at all.

Affected users should be able to sue for a lot in these basic security failures. And obviously for many of these small websites, the potential damages would quickly bankrupt the site owners, but that's the point. People would think a lot more carefully about how they protect sensitive data if there were real negative consequences for their failures.

To me, the issue is Lovable’s borderline reckless marketing: repeatedly claiming that “everyone” can build a website “without any technical knowledge” (verbatim from their website), while disclaiming all liability for bugs and placing responsibility for security on their customers.

Customers who hear day in, day out that “software is solved” and buy into Lovable’s narrative may simply have no idea that they could face substantial liability for privacy violations.

But in all cases, under GDPR, the one having the data breach is required to act. If they fail, there's steep fines, often proportional to your revenue. It will hurt the business.

E.g. here's what a ditch citizen can do and expect https://www.autoriteitpersoonsgegevens.nl/en/themes/security...

IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, the hoster does have an obligation to provide good tooling (i.e. ssh, not telnet) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories).

Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.

This was supposedly fixed on October 30, but there are reports floating around that for existing projects, the defaults still apply

https://docs.postgrest.org/en/latest/references/errors.html

For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."

Thanks for volunteering that information, I guess.

Note that the hint is added by PostgREST and it was introduced at a time where users manually typed table names, causing them to report malfunctions on typos. These hints are not that as necessary anymore so they're usually disabled via config[1] and will likely be dropped on a next version.

[1]: https://docs.postgrest.org/en/v16/references/configuration.h...

I can't believe someone actually made this by design

In practice it’s an absolutely stupid design. If you create tables without using their dashboard, like with an ORM or with SQL directly, it’s incredibly easy to have them not use RLS and be wide open to the public.

Taking a step back, the whole “query the database straight from the frontend” is a terrible design in general. For example, they still don’t offer rate limiting! Even if the tables data is secured, there’s nothing stopping someone from hammering the database directly with reads/writes until it overloads it, as there’s no application level rate limiting in the middle. Bonkers.

I agree. If AI agents are doing all the code anyway, as is the case with Lovable, just turn off the Data API entirely and access the DB from the backend only like a typical Postgres setup.

https://pocketbase.io/

True, but I've seen staff+ level developers get bit by this. What hope do vibe coders have?

Any tables created before the defaults put in place are of course still subject to the wide open defaults, because they would risk break existing users apps if they back-ported those.

The analysis was conducted with the assistance of a lawyer specializing in data protection. A deliberate decision was made to share the dataset with Lovable so they could contact their customers and have the database access issues resolved.

No matter how annoying you find a particular response! Reply and say it’s garbage instead.

To me, it feels like Lovable is an irresponsible product selling the idea that web development is trivial now with LLMs, where the reality is that although it's true that agentic coding means while anybody can spin up a website in like 10 minutes, a professional software engineer who knows what they are doing can still utilize LLMs much more effectively than an amateur ever could.

To me only hard rule like this is to never implement your own cryptographic code. A decent developer can easily implement simple session-based authentication safely, or at least I'd suspect the chance of mistakes is no higher than this developer misconfiguring a much more complex library for authentication.

This only really works with 1-person apps though. If you need multiple users then you have to match the login with specific database records to make sure you're only exposing the right stuff.

I guess that is to say, even if your authentication is great, you can still botch the authorization.

>In its marketing, Lovable repeatedly emphasizes that no technical knowledge is needed to build projects. This can give the impression that the platform takes care of security too. Yet Lovable’s Terms & Conditions place responsibility for applications and data handling on the customers themselves.

My point is that the way Lovable websites are generated pretty much made no auth or mistake prone from scratch auth stack the default path with no regard to the security problem down the line, and the people they are marketing to are not decent developers or developers at all really, but people who doesn't have much knowledge about software, which is irresponsible.

But unfortunately, it’s not always this transparent. In the US, doctors (particularly PE owned ones) often use AI in their backend in one form or the other. In one case, I observed their transcription service was using some LLM to help process data into medical record.

In other cases, your data may even be processed/leaked/trained without your explicit consent through a third party vendor that doesn’t interact directly with doctors office (physician office -> order sent to pharmacy -> pharmacy uses LLM to process data).

This is at least the case for the insidious CVS/Caremark conglomerate.

The people sharing their PII usually don't know that it's Lovable.

But they have tons of VC money so they'll get aquired by someone in the incestuous circle of SV investors.

Yes you will need SOME technical knowledge. But people are just lazy. Everyone can learn this stuff. Just ask any anthropic model how to deploy a website, it’ll tell you.

I'm the creator of Skape - an app building platform where the security is baked into the platform itself. Login and sharing data with other users all happens in the platform. This doesn't mean "your app shows its own UI and then feeds username/password to a login service" - I mean that Skape's UI handles login, and then while you use your app, Skape routes your data requests to your database. The app is treated as untrusted by the platform, which means app creators and users have to worry a lot less about the security of vibe coded apps.

I think that this is a better approach to security that will allow users to trust the software on the skape platform to a higher degree.

Check it out - https://skape.run/

Like mentioned elsewhere in this thread, there are doctors vibe coding shite and sending private medical data to Anthropic's servers, probably without even checking the "don't use for training lol" checkbox. Thousands of passports, invoices, whatever, are rn available on the open internet. People posting private company data on PUBLIC github repos (dealt with 2 such cases lol).

These individuals aren't held to the same standards, and right now nobody is enforcing the rules on them.

And maybe that's fine. Maybe we don't want to stifle innovation. But if my passport ends up on the dark web and I get identity theft'd, then I'd be pissed. There are REAL consequences.

Oh boy, open season on those entry points

although I don't use it enough to know the specific details of how it is infrastructured. But since the promise is that it writes any code that you want, it's logical that the arbitrary code is not a property of the code generating tool but of the user that generated the code!

Can someone please correct me if I'm wrong here, but isn't the article claiming that all data was publicly accessible with a read-only API key, also publicly shipped in each site?

Unless I'm missing something, no amount of digging into *published* data is a breach of anything. The act of publishing it is the leak, not the consumption.

Am I losing the plot?

I mostly see an accusation of downloading more data than needed to prove the point.

Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.

Moving too fast and putting the onus at the user is a bit shady.

We used to call this spam.

My point was to say how AI tools can quickly build insecure software systems.

Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?

Data being technically accessible doesn't mean it's meant to be accessed by anyone.

If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.

He seems a hard person to have sympathy for, which didn't help that much at all.

https://csrc.nist.gov/glossary/term/inadvertent_disclosure

If your app processes personal info, even if it's just a "sign up with your email to keep updated" list on a landing page, it needs proper security

But a warning only helps if it’s acted on, and the people affected here are end users who did not action provided findings.

Our work is to help users ship secure apps. We keep investing in making security tools better and easier to use, taking on as much of the security load as we can, shipping more secure code by design, and fixing more issues automatically.

I personally believe that making security accessible is what leads to making software accessible. We’re committed to both.

You can read more about our approach: https://lovable.dev/blog/find-it-fix-it-ship-it

7500 site operators failing to "action provided findings" seems like some systematic failure on your part and you should accept some responsibility for it. Don't allow users to publish apps if you know they leak private data.

This is the new future, I'm just not sure I want to be part of it.

"Build something Lovable

Bring a new product, internal tool, or entire company to life."

You can't market like that without having the back-end rock solid. There isn't a word about risk or responsibility there, but there are plenty of disclaimers of responsibility in their terms of service and the CISO (active in this thread) does not inspire confidence.

My personal reading is that people find it easier to put another bandaid on the top of existing one on the name of security. A sprawl of monitoring and automation tool give a sense of security while adding to the cost. It might be worthwhile to let it be visible to user, who can see the data, who can modify the data when it comes to self vs other and authenticated vs unauthenticated. And of course people are going to try to save money, these scanning features are going to show up as additional bill pretty soon.

We are committed to keeping scanners free. A new UX for security rolls out soon (this month), will get a better understanding of what is wrong, who can see what and why important to fix.

The biggest revenue you will get is from enterprise customers and thats your biggest risk too if security goes south. You already have advantage of being close to customer stories and usage behavior. Some one within the company needs to build the platform again from grounds up with all these security requirements baked into the architecture, sort of parallel project one would say.

> We are committed to keeping scanners free.

This sounds like a good sentiment in theory, however this is a double edged sword. Scanning costs money to you as company and that cost is going to make it to the customer one way or another

> these apps

Why do these companies think of their customers as total morons. Publicly demeaning them and blaming them for being victims of their stupidity is beyond ridiculous.

> And that's why I believe auto-fix will solve a lot of problems in this space

Then why didnt you do it. Why would users be interested in your 'thoughts'

As opposed to?

It's infuriating how little responsibility you are taking. And it's downright shameless of you to come here with this attitude and try to soothe the outrage with AI speak.

To be fair, one can harbor a fear of updating after bad experiences with entirely unrelated software.

unacceptable! it's all about the vibes!

Have you made an inventory of all of the places where the data ended up?

Have all parties that ended up with copies confirmed the copies are destroyed and had not been passed on?

Have you reported an inadvertent disclosure to the DPA?

On a larger note, and not at all to downplay the seriousness of this breach, but this feels like the kind of growing pain we're going to continue going through as we move to an AI-driven world. Who's responsible for the work of the AI? In this case, I think it's pretty cut and dry, since Lovable sells a service that _happens_ to be powered by AI (it could just as easily have been done by an outsourced team instead). But as AI gains more agency, it's going to become less and less clear…

  # AI Output
  
  The Services may use artificial intelligence models to
  generate code, content, or other outputs ("AI Output").
  AI Output may contain errors, inaccuracies, or other
  issues and should not be relied upon without
  independent review and testing. You are solely
  responsible for reviewing, validating, and using any
  AI Output, whether it is generated through:
  
  - our Platform's integrated AI;
  - the AI Gateway (via Third-Party AI Providers); or
  - any model or API that you connect to the Services.

For instance, questions will arise, as to whether it's reasonable for Lovable to hand this kind of power over to a customer. And, if their software is capable of detecting vulnerabilities, but allows the customer to proceed, is that reasonably responsible behavior on Lovable's part?

Then, there are tests regarding what their customers should reasonably be expected to understand. For instance, it might be tempting to compare this to gun liability laws, wherein manufacturers can disclaim responsibility if their guns are mishandled. But, here, what is the level of knowledge required to fully understand the risks—including the risk/cost of breaking a production build? And, is it reasonable that their customer should be expected to understand?

And, this even comes down to their marketing. If they are actively selling to novice customers, with the pitch that no expertise is required, then it may prove very difficult to pin the blame on those customers.

Attorneys would likely argue that Lovable can't have it both ways—selling to amateurs, then blaming their customers for being amateurs.

Disclaimer: I once played a lawyer in a 7th grade mock court. Oh, and I've been sued.

If the customer is deploying (“to prod”) they need to know enough to assess their own risks of breaking their software.

I’d want to see the text of the warning to customers before having an opinion on how in/sufficient it was.

1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?

2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.

3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?

4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.

5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?

Is this supposed to be a roadmap to security antipatterns?

As Head of Security you are not doing a good job.

you just need to buy Lovable Ultra

I knew what to expect as soon as read that in the very first sentence. Classic blameshifting. Maybe show a little bit of humility and admission of fault, you know the qualities that make people( and companies) 'lovable' and make ppl look past your mistakes.

Companies with absoloutly no moat like lovable have to win hearts first. This cya blame user response makes me want to use that site even less. Bye.

When your entry point for building an app is an AI prompt, "making security accessible" seems wildly below the standard. The role goes from making it accessible to ensuring it, given that you are marketing to clients who can't.

If there is a vulnerability the customer should have two options: patch or take down my app. Customers should _not_ be able to decide to defer/skip security if they are not technical enough to understand the impact.

It is great though that these scans are free for your users.

https://docs.lovable.dev/features/security#built-in-security...

Counterpoint: HN about the iPhone. FWIW, I agree with the statement above, but also suggest a developer account opening up developer flags is a reasonable gate.

(Not sure how else to avoid all the "developers" clamoring for non-public betas of iOS bricking their iPhones, as the same audience that would flip a bunch of dev toggles if available to everyone like developer mode in Safari then scream how Apple should have done more to protect them when their bank account is emptied.)

This is something that makes me roll my eyes... seeing people online talking about how everyone can just make their own version of w/e software now. As though running a software business is simply a matter making the computer screen light up in a particular way.

It's one of the reasons I've avoided supabase (and postgrest) because I've found any non-trivial security implemented via RLS to be a lot more difficult to implement, audit and test than equivalent middleware in express, for example.

I think it's going to be a pretty tall order to expect AI systems to nail this, as it requires quite a bit of reasoning and business domain expertise- the things that LLMs are notoriously bad at.

If your terms of service can say, "When there's a data breach, it's technically your responsibility", I'm sure it can say, "When we detect a security issue, we'll push a fix without waiting for your OK."

I thought the purpose of vibecoding platforms like Lovable was to put guardrails in place and put non-technical people into the pit of success. But apparently not?

https://www.theregister.com/software/2026/02/27/ai-built-app...

It’s not harder to grab a VPS and let Claude loose on it. But try explaining that to my dad

I would say that something like 3/4 supabase projects that are submitted have issues like this. The latest i found was exposing health-related data.

Supabase is positioned similarly to firebase: you don't need a separate backend, and you access your database directly from the frontend. Security is dependent on relatively complicated rules in your database (simpler for firebase, a lot more involved for supabase with RLS)

This means it's a tool that is frequently reached for by newbies - the same sort of people who are the worst equipped to actually implement these complicated security rules themselves. With the advent of vibecoding, many people building are almost entirely dependent on the AI doing the right thing in every case. And this will get progressively more complicated to do correctly the more complicated the schema and usage patterns become.

I think we are in a territory where it is borderline irresponsible for supabase.

In this case we're talking about vibe coders, who don't know about the implementation details. But we've gotten here in the first place because a lot of developers adopted this Supabase RLS serverless model. I always found it surprising that this model stuck.

If you're up for maintaining that, and if you're willing to suffer the serious performance hits it inevitably entails, it can be a very convenient and secure option.

The problem is that most engineers (let alone vibe coders) are decidedly terrible at db design. The outcome here is entirely predictable.

I’ve always preferred treating RLS as one layer of defense in depth, or an underlying safety net for when your backend code forgets to filter properly. Like wearing underwear just in case you get holes in your pants. I don’t think that’s Supabase’s philosophy though and that’s always bothered me.