Bullshit. That's not for the 'whitehat' to determine.

"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"

You can't know that without pulling the data.

Why do you insist on other people following your personal preferences?

The law is - contrary to your opinion - not a personal preference.

POC -> fine

Actual mass exfiltration -> not fine.

So you're a legal expert now too? You characterization of what happened as "mass exfiltration" is just that - your personal opinion.

No, OP documents that in painful detail.

https://gdpr-info.eu/art-4-gdpr/ section 12.

Under the GDPR this was a breach, pure and simple.

"pure and simple" is again - YOUR interpretation. Sorry, but this is genuinely not interesting anymore. But thanks anyway for engaging. Good luck.

It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.

> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.

The GDPR does not have a 'legitimate interest' category that includes exploiting breaches.

I think you missed that they only pulled the first page of paginated results. The opposite of exfiltration.

Of 10K+ tables...

Each of those is a separate breach in my mind

These are all separate code bases with different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)

Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.

If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.

this person has a screw loose. not sure what their deal is. maybe needs a break from the internet

I mentioned this in another comment, but for completeness: we didn’t actually pull all the data. The number would likely look much worse if we had.

> I mentioned this in another comment, but for completeness: we didn’t actually pull all the data. The number would likely look much worse if we had.

Indeed, it would look a lot worse if you had.

wtf is your problem?

He's an AI maximalist who frequently posts in AI related threads. He's being very hostile because the OP's work is a threat to his agenda.

Oh, that's hilarious. You made an account just to post this gem anonymously?

Yes, your behavior in this thread was bad enough to inspire me to create an account to comment on it.

thanks legend !

thank you for doing that work for me, i just assumed this fella has such an agenda

my second guess was meth, third strict Constitution AIst

Well, then that assumption would be completely wrong.

This is beyond silly.

How come someone's assumption would be wrong but all your assumptions are always correct? :)

There must be a limit to this.... trajectory.

I think attributing this to "meth" is uncharitable. I think that their excessive hostility in this particular instance could be an unconscious product of their belief in AI.

He's pointing out potential legal issues. Not everything is an AI problem.