Thousands of Lovable apps have exposed sensitive data
Thousands of applications created using the AI platform Lovable have exposed private chats and passport numbers, according to an investigation by the cybersecurity firm Crissy Field.
What happened?
Cybersecurity firm Crissy Field has discovered that several thousand applications built using the AI development tool Lovable have exposed sensitive user data. The leaked information includes private chat conversations and passport numbers. The data was left unprotected and accessible, leaving affected individuals vulnerable to identity theft and fraud.
Key facts
| Drabbad plattform | Lovable |
|---|---|
| Granskare | Crissy Field |
| Exponerad data | Privata chattar och passnummer |
| Omfattning | Flera tusen applikationer |
Why it matters
While AI-powered development tools have lowered the barriers to creating applications quickly, the incident highlights significant security risks regarding data storage and access control. When backend infrastructure or databases are exposed without necessary permissions, user data is at risk regardless of how quickly or easily the application was generated.
Who is affected?
The incident affects users whose personal data and chats were contained within the affected applications, as well as developers and companies that relied on Lovable to build and deploy their systems. Organizations managing the personal data of EU citizens within the tool are also impacted by potential regulatory compliance requirements.
Impact on the EU
Because Lovable apps have exposed personal data such as passport numbers and private messages, the EU General Data Protection Regulation (GDPR) is directly applicable. Incidents involving the public exposure of European users' sensitive data may trigger mandatory breach notifications to national supervisory authorities.
What else you should know
The cybersecurity firm Crissy Field conducted the investigation that revealed the vulnerabilities. It is not yet clear from the initial report whether the flaws were caused by the platform's default configurations or by incorrect settings implemented by individual creators.
Quick answers about this story
Vad har hänt?
När hände det?
Varför spelar det roll?
Påverkar det EU?
The link opens in a new window and leads to the publisher's own site.
Källan har spårats automatiskt från utgivaren via Aheadlines signalkedja.
AI-verktyg i artikeln
Topics
Get similar news straight to your inbox
The reader's room
Send in a question or an addition. The newsroom reads everything before it's published and replies when relevant. No AI-generated text – just people.
Sign in to submit a comment or question.
Read the article through your role
- Decide whether this affects strategy over 6–12 months or is just noise.
- Discuss with leadership: do we own the right question or does ownership need to move?
- Ask: what risk are we taking by NOT acting on this this quarter?
Generated angle — not editorial analysis of "Thousands of Lovable apps have exposed sensitive data"