Study finds 24,664 Lovable-built sites hand out database rows

Study finds 24,664 Lovable-built sites hand out database rows

2 November 2026: Crissy Field, a Hamburg security firm working with the German business daily Handelsblatt, says 24,664 websites built with Lovable, the AI app builder, sent records from their Supabase databases to any visitor who loaded the page, with no login and no click. In 7,403 of them it found tables holding email addresses, and the records it pulled included passport numbers, contracts, invoices and private chat messages.

Not yet independently verified. The figures are Crissy Field's own and were not tested by us; its report carries no publication date, so we date it to Handelsblatt's first article of 2 November. We found no response from Lovable. We will update this when it can be confirmed, and remove this note.

How the sites were found

The researchers started from Common Crawl, the public web archive, and picked out 159,041 Lovable projects published between December 2025 and September 2026. Of those, 34,545 used Supabase as their database, and that group was the focus. For 24,664 of them, the browser received database records as soon as the page loaded. The team then made further read-only requests with the same public API key the site itself used, which is how it reached more content, and found email addresses in 10,560 tables across 7,403 sites, 30% of the group it examined closely.

What the records held

The report lists what it saw rather than naming sites. A German lifestyle forum exposed more than 80,000 profiles with full names, email addresses, dates of birth and gender, plus more than 200,000 chat messages. Ticketing and food-sales apps exposed buyers' emails, phone numbers, postal addresses, payment details and ticket codes. One property app exposed AI-written summaries of internal emails about tenants, owners and partners. Elsewhere there were more than 1,000 records with passport numbers, expiry dates and nationalities, tens of thousands of contracts, invoices, photo albums and internal WhatsApp messages, and 280,000 emails one provider had sent to its customers.

The cause, in the report's words, is access control mistakes that follow recurring patterns in how the apps connect to their databases. Because the patterns repeat, a misconfiguration found in one app is easy to look for in thousands of others.

The authors' own caveats

Crissy Field is careful about its headline number. Some of the email addresses may be public contact details or test data, while personal records without an email were not counted at all; the authors say the two effects partly cancel out but could not measure how far. "The 30% figure should therefore not be read as a confirmed data leak rate," the report says. The Common Crawl sample is not representative of every Lovable app, only parts of each dataset were read, and the team could not tell whether anyone had misused the data.

Handelsblatt put the findings to Lovable. The report notes that Lovable's terms of service place responsibility for an application and its data on the customer who built it.

Checking an app built this way

For a business that has let staff or an agency build internal tools or customer-facing apps on Lovable or a similar builder, the useful test is the one the researchers ran: open the app logged out, watch what the browser receives from the database, and try the same public key against other tables. The report's advice is to review access rules, interfaces and the separation between user accounts before an app handles real customer data, to repeat the review after significant changes, and to bring in outside help where the skills are missing. "Automated checks are no substitute for a professional security assessment," the authors write. Our no-code platform category lists 11 products.

Related on TrustList:

• Studio breach may have exposed every account's API keys and form data

Sources

• Crissy Field GmbH: Lovable, many apps built on the platform expose sensitive data (research report, with Handelsblatt), 15 November 2026