Lovable apps expose passports, private messages

The "vibe coding" movement has collided with production security reality: generating full-stack software from prompts leads non-developers to publish client-accessible databases without proper access controls. As AI code generators abstract away infrastructure complexity, developer platforms must enforce secure-by-default primitives before real-world adoption is safe.

• –Analysis of 159,041 projects found that 30% of audited Supabase databases exposed records with personal data to unauthenticated client requests.
• –Lovable's recurring templates provision client-side Supabase keys without automatically generating or requiring Row Level Security (RLS) policies.
• –While Lovable's terms place full security responsibility on users, marketing the tool as requiring zero technical knowledge creates a dangerous security gap.
• –Standardized code generation patterns make it trivial for attackers to mass-scan and exploit identical flaws across thousands of independent apps.
• –AI app builders must integrate automated security linting and mandatory access checks before allowing deployments handling live customer data.