Thousands of apps built with the AI app builder Lovable left personal data readable by anyone, without a login. Two weeks after the findings went public, the platform fixes cover new tables and new publishes, not the data already sitting open.
The research comes from Crissy Field, a Hamburg security firm, working with the German business daily Handelsblatt, which first reported it on 2 November. Crissy Field’s English report, with updated figures, reached Hacker News on 14 November and passed 100 points within an hour.
Among the open data: more than 1,000 records with passport numbers, expiry dates and nationalities, and over 200,000 chat messages from a German lifestyle forum. Nobody broke into Lovable. The apps’ databases simply answered anyone who asked.
Source: Privacy Affairs · 2026-11-14