Lovable apps were among publicly exposed AI-built apps, researchers say
RedAccess found thousands of publicly reachable AI-built apps across four platforms; WIRED verified several exposures and Lovable says creators control configuration.
By Dominic Okoye · Staff Writer
· 3 min read
Lovable apps data exposure concerns are part of a broader set of findings involving AI-built applications hosted by Lovable, Replit, Base44 and Netlify. RedAccess researchers told WIRED they identified more than 5,000 apps across those platforms that were publicly accessible with little or no authentication, and said about 40% contained sensitive information. WIRED independently verified that several examples supplied by the researchers were still online and exposed.
The research does not establish a Lovable-only total, nor does the available evidence show a confirmed breach or defect in Lovable's platform. Lovable said it is seeking information to investigate the report and maintains that app creators are responsible for how their applications are configured.
What did researchers find in Lovable and other AI-built apps?
Dor Zvi, a cofounder of cybersecurity firm RedAccess, and his team examined web apps made with the four AI development platforms, according to WIRED. Some applications could be accessed by entering their URLs in a browser; others reportedly required only sign-in with an arbitrary email address.
RedAccess said the accessible apps included medical and financial information, corporate presentations, strategy documents and records of customer conversations with chatbots. WIRED said the examples it checked appeared to include doctors' personal information in hospital work assignments, advertising-purchase data, customer names and contact details in chatbot logs, shipping records, and sales and financial records.
Zvi also said certain apps could have allowed a visitor to obtain administrative privileges or remove other administrators. Those findings were the researchers' assessment, and WIRED did not say it independently verified every app in the sample.
The team found the apps using Google and Bing searches combining terms with domains on which the platforms host customer applications, WIRED reported. RedAccess also said it found Lovable-hosted phishing sites impersonating Bank of America, Costco, FedEx, Trader Joe's and McDonald's. That is a researcher finding, not evidence that Lovable made or approved those sites.
Is this a Lovable platform vulnerability?
The evidence currently points to publicly reachable applications and an unresolved dispute over whether the underlying issue is creator configuration, platform safeguards, or both. Lovable told WIRED it takes reports of data exposure and phishing seriously, called the matter ongoing, and said builders have tools to create secure apps but ultimately control their configurations.
That distinction is material for teams deploying applications built through natural-language prompts. Lovable's privacy policy says data submitted by people using apps built by its customers is outside the policy's direct scope: the person or organization that built an app is responsible for the data it collects and uses. The policy defines that data to include user accounts, form submissions, orders, and records held in a project's database and storage.
For operators, the report reinforces that publishing an app requires access controls and review alongside fast development workflows. Those controls form part of an enterprise security program, particularly where a project handles customer, employee or commercially sensitive records.
Lovable did not disclose a count of affected apps on its own platform in its response to WIRED. The reported 5,000-app figure and the estimate that roughly 40% exposed sensitive data apply to RedAccess's combined sample across all four platforms.
This story draws on original reporting from Sifted.
