The law is - contrary to your opinion - not a personal preference.

POC -> fine

Actual mass exfiltration -> not fine.

So you're a legal expert now too? You characterization of what happened as "mass exfiltration" is just that - your personal opinion.

No, OP documents that in painful detail.

https://gdpr-info.eu/art-4-gdpr/ section 12.

Under the GDPR this was a breach, pure and simple.

"pure and simple" is again - YOUR interpretation. Sorry, but this is genuinely not interesting anymore. But thanks anyway for engaging. Good luck.

It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.

> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.

The GDPR does not have a 'legitimate interest' category that includes exploiting breaches.

I think you missed that they only pulled the first page of paginated results. The opposite of exfiltration.

Of 10K+ tables...

Each of those is a separate breach in my mind

These are all separate code bases with different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)

Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.

If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.

this person has a screw loose. not sure what their deal is. maybe needs a break from the internet