Other Lovable users could read a public project's chat history and source code
On April 22, 2026, Lovable published its account of an access regression. Between February 3 and April 20, 2026, public project chat history and source code could potentially be accessed by any Lovable user who had the project link. The post says private projects and Lovable Cloud were never impacted, and that the regression was fixed on April 20.
What was reported
Lovable's April 22, 2026 post says that on April 20 a security researcher publicly reported that data in public Lovable projects could be read by any authenticated user. Lovable says it shipped a fix within two hours. The post says private projects and Lovable Cloud were never impacted. It says that between February 3, 2026 and April 20, 2026, public project chat history and source code could potentially be accessed by any Lovable user who had the project link. Lovable says it is continuing to review which public projects may have been viewed by Lovable users other than the project owners in that window, and that it will communicate with those project owners.
The post says chat history and source code of public projects had been accessible by design, that Lovable removed that access over 2025, and that backend regressions in February 2026 turned it back on. It says the first report through its HackerOne program arrived on February 22, 2026, and that those reports were closed without reaching Lovable's security team because the triage notes still described public chat visibility as intended behavior.
Lovable says the permission regression is fixed, so other Lovable users can no longer read the chat history and source code of public projects. It says it is making historically public projects private, except official templates on lovable.dev and an explicit option to opt in to remix. The post separates two settings: project visibility, which is who can view the editor, source, chat, and unpublished changes, and website access, which is who can open the published URL.
How to prevent it
If a Lovable project was public between February 3 and April 20, 2026, the post says its chat history and source code could potentially be accessed by any other Lovable user with the link. Lovable says that access is closed, and that it is reviewing which of those projects may have been viewed and will contact their owners. It also says it is making historically public projects private, except official templates and an explicit choice to allow remixing. Project visibility is who can open the editor, chat, and code. It is separate from who can visit the published URL.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.