Lovable denies breach after api flaw exposed user project data

Tuesday 21 April 2026 - 16:20

By: Dakir Madiha

Lovable denies breach after api flaw exposed user project data

Lovable is facing scrutiny after a security researcher revealed that a simple API vulnerability allowed unauthorized access to sensitive data across thousands of user projects. The company has denied that a data breach occurred, even as details of the flaw raised concerns about access controls and platform security.

The vulnerability, disclosed by a researcher known as @weezerOSINT, affected projects created before November 2025. It was identified as a broken object level authorization flaw, in which the system failed to verify whether a user had permission to access specific resources. According to the researcher, only five API calls from a free account were required to retrieve complete project data belonging to other users, including source code, database credentials, AI conversation histories, and customer information.

The issue was initially reported on March 3 through HackerOne, but the report was classified as a duplicate and closed without escalation to Lovable’s internal security team. Reviewers reportedly considered the behavior consistent with existing platform design, where some project elements had historically been accessible. The vulnerability remained unaddressed for 48 days before being publicly disclosed.

Lovable’s response evolved over the course of Monday. The company first stated that no data breach had occurred and attributed the exposure to unclear documentation around what constituted a “public” project. It later acknowledged that a backend change introduced in February had unintentionally restored access to project conversation histories, a feature that had previously been restricted. The company said it reversed the change immediately after becoming aware of the issue.

The startup, which reports a valuation of 6.6 billion dollars and lists companies such as Uber and Zendesk among its users, maintained that it had not been notified earlier because the bug report was not forwarded. It added that public project conversations are no longer accessible and that steps have been taken to prevent similar exposures.

The incident follows a pattern of security concerns linked to AI generated applications on the platform. Earlier in 2026, researcher Taimur Khan found that a significant number of featured apps contained critical vulnerabilities, including one case that exposed data from more than 18,000 users. The root cause was traced to missing row level security policies in databases, a recurring weakness in AI generated code that functions correctly but lacks proper access controls.

The latest disclosure has intensified debate حول the security of so called “vibe coding” platforms, which allow users to build applications through natural language prompts. Experts warn that while such tools accelerate development, they can also introduce systemic risks if generated code is not rigorously audited. The Lovable case highlights how design assumptions and overlooked authorization checks can expose large volumes of sensitive data at scale.