Lovable Platform Under Fire After AI-Generated App Exposes 18,000 Users’ Data A security researcher has uncovered critical vulnerabilities in an app hosted on the AI-driven vibe-coding platform Lovable, exposing the personal data of over 18,000 users, including students and educators from top U.S. universities. Tech entrepreneur Taimur Khan identified 16 flaws six deemed critical in an unnamed app featured on Lovable’s Discover page, which had amassed over 100,000 views and 400 upvotes. The app, designed for creating exam questions and managing grades, relied on Supabase for authentication and database management. However, due to missing security controls like row-level security (RLS) and role-based access, the AI-generated backend contained logic flaws that inverted access permissions. For example, a malformed authentication function blocked legitimate users while allowing unauthenticated attackers to access sensitive data, delete accounts, alter grades, and extract admin emails. The exposed dataset included 14,928 unique email addresses, 4,538 student accounts, and 870 records with full personally identifiable information (PII). Users spanned K-12 institutions and universities such as UC Berkeley and UC Davis. Khan criticized Lovable’s response after his initial report was allegedly closed without action, arguing that the platform should bear responsibility for apps it generates and promotes. Lovable’s CISO, Igor Andriushchenko, countered that the company received a "proper disclosure" only on February 26 and acted within minutes, noting that users are responsible for implementing security recommendations from pre-publish scans. He added that the vulnerable database was not hosted by Lovable and that the app’s creator is now addressing the issues. The incident highlights broader concerns about AI-generated code, with studies like Veracode’s finding that 45% of such code contains security flaws. While vibe coding named Collins Dictionary’s Word of the Year for 2025 aims to democratize app development, critics warn that unchecked AI tools can produce functional but dangerously insecure software. Lovable has since contacted the app’s owner to mitigate the risks.