Lovable Leaked 200K Messages and Passport Data in Breach
I've built a few throwaway apps with Lovable over the past year, mostly to see how far a plain-English prompt can stretch. What I didn't expect was stumbling onto passport scans and private conversations sitting in public view, readable by anyone who knew the URL. After scanning 159,041 Lovable projects, that's exactly what we found: over 200,000 private user messages exposed without a login, plus personal documents that should never have been accessible in the first place. Lovable grew out of an open-source tool called GPT Engineer in 2023, became a Stockholm startup, and now promises that anyone can build a web app just by describing it. The demo is impressive. But there's a real gap between describing an app and securing one, and we're watching that gap play out in production. The AI generates the code, but it doesn't tell you when you've just built something that leaks customer data. So what happens when the tool makes building easy but stays si...