Posted by armcat 5 hours ago
Edit: The answer (as neathack tells it) is: 2.5% of the sites. The reply was buried below.
Using datasets from the open web archive Common Crawl,
we identified and analyzed 159,041 Lovable projects from
December 2025 to September 2026. Of these, 34,545 used
Supabase.
24,664 websites sent database records from Supabase as
soon as they loaded, without requiring a login or any
other interaction. That alone is not a security issue:
the data may be intended for public display. But by
making additional read-only requests, we were able to
retrieve more database content. We found records
containing email addresses in 10,560 tables across 7,403
of the 24,664 websites (30%).
Edit: That's 15,9% of all Lovable websites that use Supabase.
I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.
For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.
Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.
the article mentions "we retrieved only parts of the datasets rather than downloading them in full", so a charitable interpretation might be that for each identified source candidate, they spot checked (or had a model spot check) a few individual records to have incontrovertible proof of breach of privacy, and then ran an aggregate count query to gauge the extent of breach. I think that would be fairly in line with "white hat" behavior that's doing the smallest amount of extra work towards a solid proof and clearly not taking the obvious and easy next step of downloading the remainder that would be required for self enrichment. Difficult to argue that there is an intention of malice.
A bad actor would be downloading /all/ the data and disclosing it to no one, and selling it while obscuring the source.
That said I agree that that certainly might fall afoul of the letter of whatever local laws apply, and certainly prosecutors can also be over-zealous in their interpretations. So personally I would never risk doing something that comes up against that line, from a personal risk POV. But idk if it's fair to argue that this is NOT good faith.
Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.
The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."
To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.
> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.
I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.
oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
I hope at least that that was a local model. If not you've made things considerably worse.
All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF.
I respect your insistence on proper data handling -- you’re right in doing so -- and we tried to be as careful as possible when conducting the analysis.
Now let’s hold Lovable to the same standard.
Supabase tables also use pagination, and we never downloaded more than the first page.
It looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.
This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.
I have just pointed out that there is a difference between reporting a vulnerability and actually exploiting that vulnerability.
POC -> fine
Actual mass exfiltration -> not fine.
https://gdpr-info.eu/art-4-gdpr/ section 12.
Under the GDPR this was a breach, pure and simple.
One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
Indeed, it would look a lot worse if you had.
my second guess was meth, third strict Constitution AIst
This is beyond silly.
I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).
Nothing neathack did was illegal, taking it at face value, of course.
Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.
Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.
Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.
I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue.
As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem.
Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair.
FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.
This is not a self-evident argument, what are you basing this on?
Problem scope is part of problem definition. If you dont know the scope, you dont know the problem.
"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
You can't do that without downloading the data first.
I'm really more than a little bit surprised that people here don't seem to know the difference between reporting a vulnerability, which has the potential of being exploited and actually exploiting it.
This phrase is doing a lot of lifting here. Op clearly downloaded far less than is possible.
> Do you realize that at that point in time there is a breach?
As others have said elsewhere, this is a legal opinion and IANAL. Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
> Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
How will you prove you didn't read it?
How will you prove you deleted it and that you did not make a copy?
The company has no option: it is now documented that there is a breach. They will have to report that breach (which if I were them I'd be doing immediately, they have 48 hours to do so). And then they are going to have to make a tough decision: thank you for your time and effort and hope that you really didn't read it and that you didn't copy it or play it safe and file a case against you.
Lots of companies are going to play it safe, if only because their compliance department is not going to want to take the risk of you popping up a few months later with another interesting analysis of data that you shouldn't have had in the first place. That's what makes this so risky, it turns a clear 'good deed' into something that could well end up in court. Morality rarely factors into such situations.
It seems far more likely that Lovable and Supabase won’t consider or report this as a breach, nor will they take any action against the reporter.
You seem to be confusing what feels intuitively wrong with what is actually unlawful. Law doesn't work on feelings. Where are the terms of use? Do they explicitly prohibit this kind of access? How do they define it?
If a website publishes data and provides a public key that automatically allows a browser to retrieve it, good luck arguing that your "security" was bypassed.
Also, OP mentions confidential information. That doesn't automatically make neathack liable. If I publish someone's medical records in a publicly accessible comment here, are you liable for reading them, or am I liable for publishing them on a website with essentially no access controls?
>an actual leak
Got a link? Or "just trust me, bro"?
>I would bet a sizeable amount of money
Unfortunately, my religion prohibits gambling, which we consider degenerate behavior. But by all means, keep the confidence. It would be even more impressive if it came with an actual legal argument.
He's one of the site's longest-standing users, but his arguments aren't making much sense. I'm sure he can do better, but he's too stubborn to let this go.
I have seen this with a lot of old-timers. I wish this site were a little more relaxed in general.
"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information."
This to me is proof that you actually downloaded the data, you would not have been able to present the conclusions that you did.
Anyway, I wish you best of luck with this whole affair, you did a great job at identifying a vulnerability, and then you turned it into an actual data breach. I hope that lawyer is willing to sign off on you having destroyed the data because that might become a very important issue.
Law varies significantly between jurisdictions. You're just blankly claiming it's not illegal. People have been convicted for way less than this, in different countries.
Plus, you could be creating more damages to the company by downloading more data like this, and you're not wearing a white hat when you're creating damage. A white-hat is in and out, without creating damage, with a clean report about the issue so the software provider can patch it.
What are you talking about? Which data? Is this data in the room with us right now?
This was supposedly fixed on October 30, but there are reports floating around that for existing projects, the defaults still apply.
Lovable deserves some heat for using this, but this was a choice that was made by Supabase many years ago to support making it easier to onboard potential customers, a deliberate tradeoff of less onboarding pain for less security.
I can't believe someone actually made this by design
Somehow it's okay to simultaneously set a golden path to less secure software to support your hockey stick growth model and then turn around and blame end users when it all goes wrong.
Any tables created before the defaults put in place are of course still subject to the wide open previous default configuration, because they would risk break existing users apps if they back-ported those.
https://docs.postgrest.org/en/latest/references/errors.html
For example, if you try to access a table named "secret" that doesn’t exist, Supabase might return a hint saying, "Perhaps you meant the table 'public.super_secret'."
Thanks for volunteering that information, I guess.
Can someone please correct me if I'm wrong here, but isn't the article claiming that all data was publicly accessible with a read-only API key, also publicly shipped in each site?
Unless I'm missing something, no amount of digging into *published* data is a breach of anything. The act of publishing it is the leak, not the consumption.
Am I losing the plot?
Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.
Moving too fast and putting the onus at the user is a bit shady.
We used to call this spam.
My point was to say how AI tools can quickly build insecure software systems.
Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?
I mostly see an accusation of downloading more data than needed to prove the point.
- They are an easy target, they don’t need any sophisticated hacking knowledge (article mentions inspecting network calls in browsers).
- There tons of those, and more created everyday. For the average user, they don’t know what they are using, or how risky it can be.
The initial idea behind the analysis was to start with the most basic setup and then move on to more sophisticated attacks. We never reached that second part, as so much sensitive data was already out in the open.
Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license.
The problem are product managers and engineers who build things like Lovable, that are not secure by design. Those products have no right to exist, but their alternatives could exist and let their users focus on what matters, instead of paying web development tax.
You and I wouldn’t build applications naively that could lead to people dying. People who don’t understand what they’re building might.
People are vibe coding at your hospital. They’re vibe coding at your utility company. They’re vibe coding at your pharma lab. I’ve met these people. They’re smart. They have phds. I tell them about SSL.
And then they could do something else that might result in property damage. Not at all comparable to the danger of an unlicensed pilot.
When Equifax thing happened, there was basically no repercussions. And that’s the only data breach I recall being in the news cycle for more than a week. Everything else has just been a blip since then. Also as there were no real repercussions other than some fines, companies took it as a signal that nobody cares (rightfully).
Is it now? How many hundreds of people have died as a result? How much infrastructure was destroyed?
I get the point you're trying to make, but computer security as a field has already a big problem with maximalist mindset, and it doesn't help in keeping systems of consequence actually secure and people safe from danger.
The analysis was conducted with the assistance of a lawyer specializing in data protection. A deliberate decision was made to share the dataset with Lovable so they could contact their customers and have the database access issues resolved.
To me, it feels like Lovable is an irresponsible product selling the idea that web development is trivial now with LLMs, where the reality is that although it's true that agentic coding means while anybody can spin up a website in like 10 minutes, a professional software engineer who knows what they are doing can still utilize LLMs much more effectively than an amateur ever could.
To me only hard rule like this is to never implement your own cryptographic code. A decent developer can easily implement simple session-based authentication safely, or at least I'd suspect the chance of mistakes is no higher than this developer misconfiguring a much more complex library for authentication.
>In its marketing, Lovable repeatedly emphasizes that no technical knowledge is needed to build projects. This can give the impression that the platform takes care of security too. Yet Lovable’s Terms & Conditions place responsibility for applications and data handling on the customers themselves.
My point is that the way Lovable websites are generated pretty much made no auth or mistake prone from scratch auth stack the default path with no regard to the security problem down the line, and the people they are marketing to are not decent developers or developers at all really, but people who doesn't have much knowledge about software, which is irresponsible.
This only really works with 1-person apps though. If you need multiple users then you have to match the login with specific database records to make sure you're only exposing the right stuff.
I guess that is to say, even if your authentication is great, you can still botch the authorization.
Supabase is kind of similar to Firebase in that you usually communicate directly with the browser through a JavaScript lib. So you need to pay close attention to the security rules (RLS policy in Supabase's case) to restrict data per row based on the user auth.
It's easy to get it wrong; that's why so many Firebase and Supabase databases end up exposed. The platforms have improved the UX so that it's not so common anymore, but it's definitely a gun that's easy to shoot yourself with.
You don't have to expose it like that. You can disable that client and use a server to communicate with the database, which reduces the exposed surface in exchange for complexity (by even having a backend at all).
Mix that design with users with zero tech background who know nothing about systems design and LLMs, and you have a recipe for disaster.
We use Lovable as a prototyping tool and then eject it, review, and deploy on a different platform. It works great for that use case.
If you don’t want to roll your own authn, you’re delegating to oauth (oidc) identity providers like google/apple/facebook/etc., which not everyone has an account.