On this quote by the OP:

"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."

You can't do that without downloading the data first.

Yes, you cannot determine if there is a breach of meaningless data or privacy data without inspection; as a layman, op appears to have downloaded as little as possible and inspected as little as possible to determine the nature of the problem.

So, let me get this straight: you are advocating that white hat hackers download data in bulk to determine whether or not there is a breach of privacy? Do you realize that at that point in time there is a breach?

I'm really more than a little bit surprised that people here don't seem to know the difference between reporting a vulnerability, which has the potential of being exploited and actually exploiting it.

> download data in bulk

This phrase is doing a lot of lifting here. Op clearly downloaded far less than is possible.

> Do you realize that at that point in time there is a breach?

As others have said elsewhere, this is a legal opinion and IANAL. Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.

Far less than possible but far more than needed to prove there is a vulnerability.

> Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.

How will you prove you didn't read it?

How will you prove you deleted it and that you did not make a copy?

The company has no option: it is now documented that there is a breach. They will have to report that breach (which if I were them I'd be doing immediately, they have 48 hours to do so). And then they are going to have to make a tough decision: thank you for your time and effort and hope that you really didn't read it and that you didn't copy it or play it safe and file a case against you.

Lots of companies are going to play it safe, if only because their compliance department is not going to want to take the risk of you popping up a few months later with another interesting analysis of data that you shouldn't have had in the first place. That's what makes this so risky, it turns a clear 'good deed' into something that could well end up in court. Morality rarely factors into such situations.

How do you square this with the news article being published on November 2nd, and referring to prior attempts to report going back to August?

It seems far more likely that Lovable and Supabase won’t consider or report this as a breach, nor will they take any action against the reporter.

That may well be so. But that doesn't mean this is how you do it.

I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.

Courts, especially in Germany, are typically not pleased if you take possession of the data.

For instance:

https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

And quite a few others besides.

This seems to make clear what several other commenters have been pointing to: this isn’t you relating absolute facts of law in the way you've been claiming. It’s you relating your personal ethical evaluation and your opinion about how the laws should be interpreted and followed.

That, and 280 or so company reviews, conversations with compliance officers, CISOs, auditors, pentesters, lawyers and other people in the M&A space about how those companies deal with security issues, reports and what constitutes a potential breach and what does not.

As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.

So I should expect a news post about Lovable owing GDPR fines for failure to disclose a breach any day now?

Quite possibly. If you are a data subject affected by this affair you can contact your local DPA.

And if I don’t see fines against Lovable and they don’t report this as a breach, it would seem to suggest that your stance across this post isn’t the degree of absolute fact you’ve presented it as?

> [...] nor will they take any action against the reporter.

To be fair, I don’t know for certain whether they will.

However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.

I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.

That's good news for you then.

Yes - but of course, it is not Lovable data that was downloaded. It's not them who would sue.

That said, I think that OP didn't cross the line in relation to each company, but IANAL.

Lovable is a processor, and definitely has responsibilities towards the data subjects.

Honest question: how would you determine how much data is reasonable to download and inspect while remaining "white hat"? Are you advocating they stop at a single record, since that's enough to prove that a vulnerability exists? Or that OP downloaded _more_ than necessary and should have stopped earlier (but not at the first instance)?

Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

Put another way, since it's been put on Common Crawl, which presumably follows rules about what to scrape, hasn't Lovable effectively published this data?

If you're researching I would stop at the minimum required to determine that there is an issue, maybe you have a lawyer that will tell you different. This being Germany I would play it very safe. From the company's perspective there is no difference between downloading 1, 10 or 50,000 records to prove the point, though they likely will respond a bit quicker if you tell them you could download tens of thousands of records.

> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.

There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.

The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.

And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.

Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.

To clarify: no PII leaked from Lovable apps ended up in Common Crawl. Common Crawl was used solely to identify Lovable apps—not to retrieve leaked data. It does not store XHR responses, which are how data is retrieved from Supabase.

(Copied from another comment of mine.)

The point is that once you realize you're seeing data you shouldn't be seeing, you should either stop and just report it, or save the smallest amount reasonable to demonstrate the issue.

IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.

He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.

Isn't this what you're getting at jacquesm?

Yes, and you are putting it better than I did.