Lovable apps expose passport details and more than 200K private messages

Re:Lovable apps expose passport details and more than 200K p... by ahtihn on Saturday November 14, 2026 @06:03PM (#50501956)

Hasn't there been cases where people got charged for unauthorized access to computer system by simply changing some identifier in the URL?

Data being technically accessible doesn't mean it's meant to be accessed by anyone.

If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by proxyscore on Saturday November 14, 2026 @06:10PM (#50502021)

Well, there was. But inputting or editing a url is akin to submitting a form or a get request, if somebody doesn't know how to not get breached by such events, they have no business running a website with delicate data

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by cowlevel on Sunday November 15, 2026 @05:47AM (#50505869)

If I don't even install door locks I have no business running a security company, that is true, and also, it's still illegal to break in.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by brewtide on Saturday November 14, 2026 @06:22PM (#50502128)

Yeah. If I remember correctly it was 'weev' and something to do with AT&T.

He seems a hard person to have sympathy for, which didn't help that much at all.

[ Parent | on HN ]