GoKawiilSecurity researchers find exposed passport data and 200,000+ private messages in Lovable-built apps
An investigation conducted with Handelsblatt examined applications built on the AI app-building platform Lovable and found sensitive data, including passport details and over 200,000 private messages, left accessible without proper protection. Lovable's terms place responsibility for securing applications and data on the customers who build them, rather than on the platform itself.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings highlight a gap between Lovable's marketing, which promotes building apps without technical knowledge, and the security expertise actually required to configure access controls correctly. This suggests that non-technical users building apps with sensitive data may unknowingly expose that information, since the platform does not appear to guarantee security by default.
- Researchers found passport details and over 200,000 private messages exposed in Lovable-built apps.
- Lovable's terms assign data-protection responsibility to customers, not the platform.
- Marketing no-code ease alongside customer-owned security creates risk for non-technical builders.
Source: crissyfield.de, 2026-11-14
Published there as: “Lovable apps expose passport details and more than 200K private messages”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.