Lovable apps expose passport details and more than 200K private messages

Re:Lovable apps expose passport details and more than 200K p... by schrodinger on Saturday November 14, 2026 @06:05PM (#50501973)

Honest question: how would you determine how much data is reasonable to download and inspect while remaining "white hat"? Are you advocating they stop at a single record, since that's enough to prove that a vulnerability exists? Or that OP downloaded _more_ than necessary and should have stopped earlier (but not at the first instance)?

Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

Put another way, since it's been put on Common Crawl, which presumably follows rules about what to scrape, hasn't Lovable effectively published this data?

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by jacquesm on Saturday November 14, 2026 @06:13PM (#50502058)

If you're researching I would stop at the minimum required to determine that there is an issue, maybe you have a lawyer that will tell you different. This being Germany I would play it very safe. From the company's perspective there is no difference between downloading 1, 10 or 50,000 records to prove the point, though they likely will respond a bit quicker if you tell them you could download tens of thousands of records.

> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.

There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.

The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.

And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.

Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.

[ Parent | on HN ]

Re:Lovable apps expose passport details and more than 200K p... by neathack on Saturday November 14, 2026 @06:53PM (#50502348)

To clarify: no PII leaked from Lovable apps ended up in Common Crawl. Common Crawl was used solely to identify Lovable apps—not to retrieve leaked data. It does not store XHR responses, which are how data is retrieved from Supabase.

(Copied from another comment of mine.)

[ Parent | on HN ]