Case lovable-pre-nov-2025-projectsModel & data leakSweden
Researcher: free Lovable account could read source, Supabase keys and chats of pre-Nov 2025 projects
A researcher posting as weezerOSINT disclosed that any free Lovable account could access other users' source code, Supabase database credentials, AI chat histories and connected customer data for projects created before November 2025.
HighAttack on AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 20, 2026
- Location
- Sweden
- Target
- Lovable projects created before November 2025
- Severity
- High
- Triggered by
- weezerOSINT (researcher)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
A researcher posting as weezerOSINT disclosed that any free Lovable account could access other users' source code, Supabase database credentials, AI chat histories and connected customer data for projects created before November 2025.
Impact: Potential exposure of source code, database credentials, prompt histories and customer data for every pre-November 2025 project; scale and exploitation unconfirmed
Who triggered it
Actor: weezerOSINT (researcher)
Attribution: Public disclosure on X by the researcher, amplified by BoldMetrics CTO Morgan Linton; Lovable had not responded at time of reporting
Motive: Security research and public warning
How it happened
Attack vector: Platform-side access control gap allowing cross-account reads of project assets
Root cause: Reported authorization flaw affecting all projects before a November 2025 platform change; not confirmed by Lovable
Timeline
- Researcher discloses the exposure on X; Morgan Linton amplifies the warning
- Bastion summarises the claims alongside the 2025 RLS CVE and a February 2026 incident
Response
No Lovable statement on the April disclosure reported; its CISO earlier pointed to free pre-publish security scans
Current status: Under investigation
Sources (open in a new tab)
- Bastion bastion.tech
- Superblocks (background on 2025 CVE) superblocks.com
Cite this case
Researcher: free Lovable account could read source, Supabase keys and chats of pre-Nov 2025 projects. AI Threat Watch, case lovable-pre-nov-2025-projects, Apr 20, 2026. https://aithreat.io/cases/lovable-pre-nov-2025-projects/
Permanent link: https://aithreat.io/cases/lovable-pre-nov-2025-projects/