Photo via Fast Company
A significant security vulnerability was discovered in Lovable, an AI-powered coding platform that allows developers to build applications using natural language prompts. According to Fast Company, a researcher identified that users' source code, database credentials, and chat histories with AI models were accessible to other platform users through an application programming interface (API). The exposure affected projects created before November 2025, raising questions about data handling practices at rapidly scaling tech startups.
The vulnerability was reported by security researcher @weezerOSINT through HackerOne, a bug bounty platform, in early March. The researcher noted that the breach could be discovered in roughly 30 minutes—a process that would have taken significantly longer before AI tools became available. Lovable initially characterized the exposure as 'intentional behavior' tied to public project settings, but later clarified that chat histories should never have been accessible regardless of visibility settings, admitting a backend configuration error in February inadvertently re-enabled access.
Lovable's response sparked debate within the developer community about transparency and product design. The company acknowledged that documentation around 'public' project visibility was unclear and implemented corrections retroactively. By December 2025, Lovable made all new projects private by default—a significant policy shift that underscores growing concern about protecting sensitive information in collaborative development environments, particularly as AI-generated content becomes more prevalent.
The incident comes as Lovable continues its rapid growth trajectory, having raised $330 million in December 2025 at a $6.6 billion valuation. For Charlotte-area technology companies and developers considering AI-assisted coding tools, the incident serves as a reminder to carefully review platform security practices and data handling policies before integrating external tools into workflows, especially those handling proprietary code or sensitive customer information.
