Incident feed · ShipSecurely

Lovable incidents

2 incidents tagged Lovable, newest first.

Topic

Information disclosureApr 22, 2026
Other Lovable users could read a public project's chat history and source code
On April 22, 2026, Lovable published its account of an access regression. Between February 3 and April 20, 2026, public project chat history and source code could potentially be accessed by any Lovable user who had the project link. The post says private projects and Lovable Cloud were never impacted, and that the regression was fixed on April 20.
- Lovable
- AI-generated code
Information disclosureMay 30, 2025
Lovable-generated sites with missing RLS let unauthenticated users read or write tables
On May 30, 2025, CVE-2025-48757 was published for Lovable. It says an insufficient row level security policy through April 15, 2025 let remote unauthenticated attackers read or write arbitrary database tables on generated sites. The record rates that Critical, CVSS 3.1 score 9.3, and notes that the supplier disputes it.