A HackerOne report called it "intended design." It was a free pass to your database.

A security researcher needed five API calls to read another stranger’s database password on Lovable. Not an edge case, not a jailbreak — a documented, reproducible path, open to any free account, against every project built on the platform before November 2025. Source code, Supabase credentials, Stripe customer IDs, and the full AI chat history where a founder had argued with the model about their own table structure — all of it readable by someone who never signed up for that project.

Someone had already told Lovable. A HackerOne report (#3583821) flagged the flaw on March 3, 2026. It was triaged, folded into an older ticket, and closed. Lovable’s own read, at the time, was that this was intended design. Forty-eight days later, with nothing patched, the researcher who filed it — disclosing publicly on X on April 20 — published the exploit instead, along with a proof against a real project: a Danish nonprofit called Connected Women in AI. Full admin panel, full source, the works. Lovable fixed it within the week of going public, not the week of being told.

This is the part worth sitting with if you’ve ever filed a bug and watched it sit: the gap wasn’t technical. The fix, once it landed, was a standard object-level authorization check — look up who’s asking before returning what they asked for. Forty-eight days is how long “intended design” survives contact with an audience instead of a form.

Three weeks later, on May 7, the Israeli security firm RedAccess gave Axios and WIRED a different number: 380,000 publicly reachable projects, scanned across Lovable, Base44, Replit and Netlify, no exploit required — just the URL, because these platforms ship a new project set to public by default and leave the owner to find the toggle. About 5,000 of those were actively leaking something real: medical records, clinical trial data, unredacted customer-service transcripts, a shipping company’s port schedules, a bank’s internal financials. A few were phishing pages, built on Lovable, wearing Bank of America’s and FedEx’s logos.

Four separate companies, four separate codebases, the same two defaults: ship public, and don’t check who’s asking. Broken object-level authorization (BOLA) has been the #1 entry on OWASP’s API Security Top 10 since the list existed — it’s not an exotic bug, it’s the first thing a security review looks for, and it’s exactly the kind of invisible plumbing an AI model won’t write unless you know to ask for it specifically. Most people generating an app in one prompt don’t know that question exists.

I read these incidents the way I read everyone else’s generated output — not to feel smug about it, but because figuring out who ends up holding the data is the same question I’ve been building FOKL’s answer to, which right now is only “the data never leaves the one device it’s on,” nothing shipped, nothing to click. The honest version of that bet is boring: there’s no backend to leave public.