Lovable apps expose passport details and more than 200K private messages

Re:Lovable apps expose passport details and more than 200K p... by technion on Saturday November 14, 2026 @05:56PM (#50501892)

Im not sure why you're arguing for an nda. Ive done a lot of security work under contract, the nda consistently means the company will file the report away and never talk about it again.

If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by jacquesm on Saturday November 14, 2026 @06:00PM (#50501938)

Under an NDA you might be allowed to download bulk data and use it to see if you can get further into the system.

Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by fn-mote on Saturday November 14, 2026 @08:11PM (#50502942)

I would rather the company’s practices be exposed than my info appear as yet another HIBP entry.

Even if the company ends up paying damages, it’s too late for the true victims.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by jacquesm on Saturday November 14, 2026 @08:47PM (#50503177)

That's true. The GDPR was made well before AI and I suspect that there will be an update that will take the new reality into account.

[ Parent | on HN ]