Thousands of apps built using the vibe-coding platform Lovable have exposed sensitive user data, including passport numbers and private messages, according to recent research. Security researchers identified vulnerabilities that left personal information accessible to unauthorized parties. The findings highlight significant privacy risks associated with rapid AI-assisted development tools. Experts warn that the scale of exposure could impact millions of users globally. The investigation underscores the need for stricter security standards in the no-code and low-code app development space.
Lovable, a platform enabling rapid application creation, has become popular among developers seeking to build software quickly. However, the underlying architecture of some generated apps failed to properly secure user databases. Researchers discovered that sensitive fields, such as identification documents and chat logs, were left unprotected. This breach represents a critical flaw in the default security configurations of automated development environments.
The discovery comes amid growing scrutiny of AI coding assistants and their output. While these tools accelerate development, they may inadvertently introduce security weaknesses. Developers are advised to review and harden the code generated by such platforms. The incident serves as a cautionary tale for the tech industry about the balance between speed and safety in software creation.
Source: Sifted · Summarized by HeadlinesBriefing