Short answer
Crissy Field, a German security firm, analyzed 159,041 sites built with the AI app builder Lovable and found that 24,664 of the Supabase-based ones returned database records to any visitor without logging in. The researchers blame poorly configured Supabase databases. Whether any data was misused is not known.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Lovable-built web apps (Supabase databases) |
|---|---|
| Incident type | Data leak |
| Status | Under investigation |
| Sector | Software (AI app builder) |
| Country | Germany |
| Disclosed | 2026-11-02 |
| People or records affected | 24,664 of 34,545 Supabase-based Lovable sites studied returned database records on load, per the researchers. The firm says this is not a confirmed leak rate. |
What data was exposed
- Names, email addresses, dates of birth and gender (forum profiles)
- Chat messages, newsletter sign-ups, waiting lists and support requests
- Ticket and meal-sale records with phone numbers, addresses, payment information and ticket codes
- Passport numbers, expiry dates and nationalities at one service provider
- Contracts, invoices, photo albums and internal WhatsApp messages
What the researchers found
Crissy Field, a German security firm, used the open Common Crawl web archive to identify 159,041 Lovable projects published between December 2025 and September 2026. Of those, 34,545 used the Supabase database service. According to Techzine, 24,664 sites sent database records to the browser on page load, with no login.
The Crissy Field report says further read-only requests with the same public key returned more content. The researchers did not publish access details and say they retrieved only parts of the datasets. Handelsblatt reported on the findings on 2 November 2026, according to the report.
What was exposed
Examples include a German lifestyle forum with more than 80,000 profiles (full names, emails, birth dates, gender) and more than 200,000 chat messages. Event organizers and restaurants exposed tens of thousands of ticket and meal-sale records with phone numbers, addresses, payment information and ticket codes. A service provider exposed over 1,000 identity records with passport numbers, and one case included 280,000 sent customer emails.
How to read the numbers
Some of this data is public by design, such as a published event page. The researchers say emails were found in 10,560 tables on 7,403 sites, about 30 percent of the sites that returned records, but they stress that is not a confirmed leak rate. Emails could be public contacts or test data, and the sample covers only certain sites.
Cause and responsibility
The researchers attribute the problem to poorly configured Supabase databases, and say Lovable’s integrations follow the same patterns, so a method that works on one app can work on others. The sources we read contain no statement from Lovable. Individual site owners remain responsible for their own data, and we name no individual site here.
Why this matters for scams
If your email, phone number or ticket data sat in an open table, a scammer could use it for believable phishing. Our guides on phishing messages and online shopping scams cover what to check, and what to do after a data breach lists next steps. Passport numbers raise the stakes, because they enable identity fraud.
What owners should check
Apps built quickly with AI tools can ship without access rules on the database. Open your site logged out, look at the data its API calls return, and add row level security before real customer data arrives. See more incidents in the breach tracker.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing and spam using email addresses, names and event or ticket details taken from open databases.
- Identity fraud if passport details or birth dates were copied from an exposed table.
- Fake ticket, refund or order-problem messages that quote real purchase details.
- Extortion of site owners by people who found the open database before the owner did.
What to do if you are affected
- 01If you run a site built with an AI app builder, check that every database table has access rules (row level security in Supabase) and that the public key cannot read private tables.
- 02Test your site while logged out and look for records returned by the API calls the page makes.
- 03If a service you used sends a notice, treat messages quoting your purchase or ticket with care and verify them in the official app.
- 04Rotate API keys and notify your users and the data protection authority where personal data was readable by the public.
- 05Use a unique password and watch for phishing if an app you signed up to holds your email and birth date.
Frequently asked questions
Is Lovable itself hacked?
No. The researchers describe misconfigured Supabase databases in apps built with Lovable, not an intrusion into Lovable's own systems. They say Lovable's database features from late 2025 were not part of the study.
How many sites were exposed?
Of 34,545 Supabase-based sites, 24,664 returned database records on load. The firm warns some of that data may be meant to be public, and that its sample is not representative of all Lovable apps.
Does the 30 percent figure mean 30 percent leaked?
No. Email-containing records were found on 7,403 sites, but the researchers say that is not a confirmed leak rate because the emails could be public contacts or test data.
Was the data misused?
The researchers could not determine whether any of the data was misused.
What did Lovable say?
The sources we read do not include a Lovable statement.
Sources
- Duizenden Lovable-apps lekken persoonsgegevens, Techzine, 2026-11-04
- Lovable data exposure research, Crissy Field, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.