Physix Frontier badgePhysix Frontier
PublishChinese | EN

Physix Frontier · News Briefing Card (Hacker News · Nov 3, 2026)

Lovable-built apps leak user data, including passports and payment info

KEY FACTS

  • German security firm Crissy Field scanned 159041 Lovable projects.
  • The scan found 7403 sites where databases containing email addresses could be read publicly.
  • Some apps exposed passport numbers, payment information and 200000 chat records without requiring a login to access.
  • Lovable's terms of service assign responsibility for apps and data to customers.
  • Lovable responded that the problem is widespread across the entire industry.

KEY DATA

159041Projects scanned
7403Sites with readable emails
200000Exposed chat messages

PHYSIX OBSERVATION

No-code AI site building lowers the development barrier to zero, and it also pushes security responsibility onto users who do not understand security. Databases exposed by default configuration are not an isolated incident but a systemic risk of this class of platform. If platforms rely only on terms of service to disclaim liability, user data will keep sitting out in the open, and regulators and secure-by-default design need to catch up.

Source: Hacker News report