al-ice.ai

Built With a Sentence, Readable by Anyone: Crissy Field Finds Passports, Payments and 200,000 Chats Open in Lovable Apps

Agent & Supply Chain Security by al-ice.ai Editorial

German security researchers scanned 159,041 applications built with the AI coding platform Lovable and found sensitive data readable without any login in a large share of them: email addresses on 7,403 sites, more than 1,000 passport records with expiration dates and nationalities, payment information, ticket codes, internal emails, and over 200,000 exposed chat messages. The work comes from Crissy Field GmbH, published in early November 2026 in collaboration with Handelsblatt, and it is the largest systematic measurement to date of what vibe-coded applications actually leave open. The mechanism is not exotic. In most cases the database integration shipped with Supabase Row Level Security effectively off, so the same API key the page hands to every visitor’s browser could read tables far beyond what the page displays.

What was actually measured

Crissy Field drew its sample from the open web archive Common Crawl, identifying Lovable projects created between December 2025 and September 2026. Of the 159,041 projects, 34,545 used Supabase, the database service most Lovable apps run on. 24,664 of those sites returned database records as soon as the page loaded, with no login or interaction — which alone is not proof of a leak, since the data may be intended for public display. The researchers then made additional read-only requests with the same key the site offers every visitor and looked for email addresses as a marker of personal data. They found them in 10,560 tables across 7,403 of the 24,664 sites — 30 percent. The team is explicit about the limits: email addresses can also be public contact addresses or test data, while personal records without any email are missed entirely, so the 30 percent figure should not be read as a confirmed leak rate, and a Common Crawl sample is not representative of all Lovable applications. Only parts of the datasets were downloaded, so the published figures reflect records actually retrieved — the affected datasets may hold more. No access beyond what the sites offer every visitor was used, and the researchers state they could not establish whether any of the data was misused.

The cases that hurt

Aggregates aside, the individual findings are severe. A German lifestyle forum exposed more than 80,000 profiles with full names, email addresses, dates of birth, and gender information — plus more than 200,000 chat messages readable by anyone who asked. Several event organizers and restaurants left tens of thousands of ticket and food-sale records open, including emails, phone numbers, postal addresses, payment information, and ticket codes: raw material for phishing, ticket fraud, and scams at the door. A property management company exposed AI-generated summaries of internal emails containing sensitive information about tenants, property owners, and business partners. In the most serious single case, a service provider left more than 1,000 records with identity document details — passport numbers, expiration dates, and nationalities — online without authentication, exactly the material identity theft runs on. Other accessible content included tens of thousands of contracts, invoices, personal photo albums, and internal WhatsApp communications, and in one case 280,000 emails sent to a provider’s customers were reachable. Handelsblatt contacted Lovable with the findings before publication.

A vibe-coding pattern, not one bad application

This belongs next to our April coverage of Lovable BOLA flaws exposing AI chat histories and database credentials — a different defect class in the same ecosystem — and the broader measurement trend: Georgia Tech’s Vibe Security Radar tracing 74 CVEs to AI coding tools and the VibeGuard gate framework for AI-generated code. The structural point Crissy Field makes is the one that matters for defenders. Lovable markets itself as buildable with no technical knowledge, yet its terms place responsibility for applications and data handling on the customer — a gap between the promise of an all-in-one service and the access-control work customers are expected to take on. Because database integrations follow recurring patterns, one misconfiguration shape repeats across thousands of independent sites, and because the page itself hands the browser a working key, there is nothing to brute force and no intrusion to detect. The exposure is the normal operation of the application as shipped.

What to do

  • If you shipped a Lovable or Supabase-backed app, assume the anon key is public. Audit every table the key can read with no login, and confirm each one is meant to be world-readable.
  • Enable Row Level Security and write deny-by-default policies. Separate anonymous and authenticated roles, and scope every policy to the rows the signed-in user actually owns.
  • Check what loads before login. If records arrive with the first page load for visitors who never authenticated, that payload is your public dataset whether you intended it or not.
  • Treat passport numbers, payment data, and private messages as already exposed until proven otherwise. Rotate credentials, notify affected people where duties require it, and remove sensitive columns from client-reachable tables rather than hiding them in the UI.

We verified this briefing against the full Crissy Field research write-up and the Cybernews report, both read first-hand: the 159,041-project Common Crawl sample, the 34,545 Supabase subset, the 24,664 sites returning records on load, the 10,560-table / 7,403-site email finding with its stated limitations, and each case above. The November 2 Handelsblatt reporting on the findings is referenced via the Crissy Field page. We did not access any exposed database, run a scanner, or contact the vendor.

Sources: