Using datasets from the open web archive Common Crawl,
we identified and analyzed 159,041 Lovable projects from
December 2025 to September 2026. Of these, 34,545 used
Supabase.
24,664 websites sent database records from Supabase as
soon as they loaded, without requiring a login or any
other interaction. That alone is not a security issue:
the data may be intended for public display. But by
making additional read-only requests, we were able to
retrieve more database content. We found records
containing email addresses in 10,560 tables across 7,403
of the 24,664 websites (30%).
What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information.
Edit: That's 15,9% of all Lovable websites that use Supabase.
Don't you think you should have reported this after you established the principle rather than to download more than you needed to do so? Because it looks to me as though you went from 'white hat hacker' to 'quite probably criminal' without a really good reason.
What I mean is: you knew it worked before you went and pulled more data, you could have stopped after the first two records, why pull more than you needed to prove that it was possible?
We retrieved only enough data to determine whether it was privacy-sensitive, which could not be reliably assessed from just two records. We did not download any more than that.
Supabase tables also use pagination, and we never downloaded more than the first page.
You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.
I may not be the intended audience, but as the author of a similar system having a benchmark like this of what user behavior can result in when it’s unconstrained is helpful for my safety evals. So in an indirect way, you’re making future platforms more secure by sharing this.
It's personal data breach for the controller (Lovable or the company that manages the app. Probably latter unless they are determined to joint controllers). It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).
Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.
That's an important bit of information that probably should make it into the blog, and I hope you guys made the right call, but I think that that is probably not the case. Best of luck.
oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
I hope at least that that was a local model. If not you've made things considerably worse.
It’s mentioned in the Handelsblatt article linked in the blog post. Since the lawyer was brought in by the newspaper, we didn’t mention their involvement in the post.
All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF.
I respect your insistence on proper data handling -- you’re right in doing so -- and we tried to be as careful as possible when conducting the analysis.
The lawyer that was brought in by the newspaper was making sure the newspaper wouldn't end up being liable. The only lawyer whose advice you should take is the one that you pay.
As long as they are representing someone I think lawyers have the same obligations regardless of who actually pays them or if they are receiving any payment at all.
When it comes to law, you're obviously punching about your weight.
I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).
Nothing neathack did was illegal, taking it at face value, of course.
Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.
Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.
Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.
I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue.
As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem.
Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair.
FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.
Leaving aside the legal argument and focusing on the technical side: Lovable is a Swedish company, but websites generated by Lovable are hosted on servers around the world. That said, the actual data is stored on Supabase servers, which -- as far as I know -- are located in the US.
"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
You can't do that without downloading the data first.
Yes, you cannot determine if there is a breach of meaningless data or privacy data without inspection; as a layman, op appears to have downloaded as little as possible and inspected as little as possible to determine the nature of the problem.
So, let me get this straight: you are advocating that white hat hackers download data in bulk to determine whether or not there is a breach of privacy? Do you realize that at that point in time there is a breach?
I'm really more than a little bit surprised that people here don't seem to know the difference between reporting a vulnerability, which has the potential of being exploited and actually exploiting it.
This phrase is doing a lot of lifting here. Op clearly downloaded far less than is possible.
> Do you realize that at that point in time there is a breach?
As others have said elsewhere, this is a legal opinion and IANAL. Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
Far less than possible but far more than needed to prove there is a vulnerability.
> Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
How will you prove you didn't read it?
How will you prove you deleted it and that you did not make a copy?
The company has no option: it is now documented that there is a breach. They will have to report that breach (which if I were them I'd be doing immediately, they have 48 hours to do so). And then they are going to have to make a tough decision: thank you for your time and effort and hope that you really didn't read it and that you didn't copy it or play it safe and file a case against you.
Lots of companies are going to play it safe, if only because their compliance department is not going to want to take the risk of you popping up a few months later with another interesting analysis of data that you shouldn't have had in the first place. That's what makes this so risky, it turns a clear 'good deed' into something that could well end up in court. Morality rarely factors into such situations.
That may well be so. But that doesn't mean this is how you do it.
I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.
Courts, especially in Germany, are typically not pleased if you take possession of the data.
This seems to make clear what several other commenters have been pointing to: this isn’t you relating absolute facts of law in the way you've been claiming. It’s you relating your personal ethical evaluation and your opinion about how the laws should be interpreted and followed.
That, and 280 or so company reviews, conversations with compliance officers, CISOs, auditors, pentesters, lawyers and other people in the M&A space about how those companies deal with security issues, reports and what constitutes a potential breach and what does not.
As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.
And if I don’t see fines against Lovable and they don’t report this as a breach, it would seem to suggest that your stance across this post isn’t the degree of absolute fact you’ve presented it as?
> [...] nor will they take any action against the reporter.
To be fair, I don’t know for certain whether they will.
However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.
I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.
The whole thing was very professional and he was appreciative of our work.
Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.
Honest question: how would you determine how much data is reasonable to download and inspect while remaining "white hat"? Are you advocating they stop at a single record, since that's enough to prove that a vulnerability exists? Or that OP downloaded _more_ than necessary and should have stopped earlier (but not at the first instance)?
Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?
Put another way, since it's been put on Common Crawl, which presumably follows rules about what to scrape, hasn't Lovable effectively published this data?
If you're researching I would stop at the minimum required to determine that there is an issue, maybe you have a lawyer that will tell you different. This being Germany I would play it very safe. From the company's perspective there is no difference between downloading 1, 10 or 50,000 records to prove the point, though they likely will respond a bit quicker if you tell them you could download tens of thousands of records.
> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?
That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.
There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.
The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.
And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.
Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.
To clarify: no PII leaked from Lovable apps ended up in Common Crawl. Common Crawl was used solely to identify Lovable apps—not to retrieve leaked data. It does not store XHR responses, which are how data is retrieved from Supabase.
The point is that once you realize you're seeing data you shouldn't be seeing, you should either stop and just report it, or save the smallest amount reasonable to demonstrate the issue.
IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.
He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.
You seem to be confusing what feels intuitively wrong with what is actually unlawful. Law doesn't work on feelings. Where are the terms of use? Do they explicitly prohibit this kind of access? How do they define it?
If a website publishes data and provides a public key that automatically allows a browser to retrieve it, good luck arguing that your "security" was bypassed.
Also, OP mentions confidential information. That doesn't automatically make neathack liable. If I publish someone's medical records in a publicly accessible comment here, are you liable for reading them, or am I liable for publishing them on a website with essentially no access controls?
>an actual leak
Got a link? Or "just trust me, bro"?
>I would bet a sizeable amount of money
Unfortunately, my religion prohibits gambling, which we consider degenerate behavior. But by all means, keep the confidence. It would be even more impressive if it came with an actual legal argument.
> I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue
It was strictly necessary to show the extent of the problem, which will lead to less products leaving their users' data exposed.
It's true that it might lead to legal problems, but there's no doubt that they were morally in the right, and that it's the laws that might punish this that are wrong and harmful.
They downloaded data, didn't (probably) do anything bad with it, and warned everyone about the problem, while in all likelihood many criminals already took it and used it without telling anyone.
You can give people legal advice, but you can't argue that they did anything morally wrong.
> Nothing neathack did was illegal, taking it at face value, of course.
Law varies significantly between jurisdictions. You're just blankly claiming it's not illegal. People have been convicted for way less than this, in different countries.
Plus, you could be creating more damages to the company by downloading more data like this, and you're not wearing a white hat when you're creating damage. A white-hat is in and out, without creating damage, with a clean report about the issue so the software provider can patch it.
How do you know which websites are affected without sampling data from each website in question? As the blog explains, it's safe to serve public data from Supabase in this manner, so the only way to determine whether the website has an issue is to look at the actual records they are serving. Their approach seems entirely reasonable to me.
As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.
Yes, would you like the report to be what you need to know or a report that will cause you to have to report an actual breach rather than just a vulnerability? Because that is what this is.
How does that relate to e.g. have I been pwnd? If the obligation to be a white hat is to protect the owners of the information then is it not also to inform the persons who have been impacted a valid white hat activity? From my perspective the classification of someone as a black hat should be if they use it for something malicious. And if anything disclosure limits any potential use. On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.
You'll notice that the person that built have I been pwnd has been extremely careful in how the data comes into their possession, I highly doubt they would ever go so far as to breach a site themselves. It would go completely against their mission to do so.
> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.
I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.
[−]reassess_blind · 2026-11-14 Sat 21:37 UTC ·
link
Do you think Lovable would be transparent as to the extent of the problem? Or would they use terminology like “a small subset of our users” and “data not including card details” or whatever to minimize the issue.
I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.
That's a good question. But it is a very fine line between being a white hat that reports a vulnerability in good faith and someone who actually exploits that vulnerability and turns a vulnerability report into an actual breach. This is - in my opinion, clearly the HN hive mind disagrees - across that line.
For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.
Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.
the article mentions "we retrieved only parts of the datasets rather than downloading them in full", so a charitable interpretation might be that for each identified source candidate, they spot checked (or had a model spot check) a few individual records to have incontrovertible proof of breach of privacy, and then ran an aggregate count query to gauge the extent of breach. I think that would be fairly in line with "white hat" behavior that's doing the smallest amount of extra work towards a solid proof and clearly not taking the obvious and easy next step of downloading the remainder that would be required for self enrichment. Difficult to argue that there is an intention of malice.
A bad actor would be downloading /all/ the data and disclosing it to no one, and selling it while obscuring the source.
That said I agree that that certainly might fall afoul of the letter of whatever local laws apply, and certainly prosecutors can also be over-zealous in their interpretations. So personally I would never risk doing something that comes up against that line, from a personal risk POV. But idk if it's fair to argue that this is NOT good faith.
I don't argue it is not good faith. I just wonder if OP realized that they might be crossing a line they shouldn't be crossing, ever, while doing security research without being under contract to the party they are investigating.
Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.
The numbers mentioned are pretty serious: "We found records
containing email addresses in 10,560 tables across 7,403
of the 24,664 websites (30%)."
To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
Im not sure why you're arguing for an nda. Ive done a lot of security work under contract, the nda consistently means the company will file the report away and never talk about it again.
If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.
Under an NDA you might be allowed to download bulk data and use it to see if you can get further into the system.
Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.
> I just wonder if OP realized that they might be crossing a line they shouldn't be crossing, ever, while doing security research without being under contract to the party they are investigating
yeah, good question - agreed that probably a lot safer to do this with explicit permission, though like others mentioned the tradeoff is that the company can cover it all up before it's clear just how bad the problem ever was and then say "we fixed a minor issue". I wouldn't risk my neck over that, but some people might I guess.
> To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
To me it sounds like they downloaded one or two records each from 10,560 tables and confirmed that those records contained emails. But you're right, I'm not sure it's very clear from the description.
[−]doctorpangloss · 2026-11-14 Sat 21:54 UTC ·
link
the concern trolling discourse of hacker news strikes again
If you happen to know the right amount to download to be able to prove a problem to interested parties and the affected suppliers, that factors in the uncertainty over possible levels of recalcitrance of said suppliers, feel free to share it. Bonus points if it has a coefficient for setting the appropriate level of transparency you’d like to force from the supplier in egregious cases.
I see that you get downvoted a lot, and that's unfortunate because that seems like a valid point to me.
This said, the reality you seem to describe about pentesting (if I use the word correctly) is very sad to me. I truly respect that security people would go out of their way to make absolutely certain they don't hurt the feeling of the vulnerable website owner so that they don't get sued.
I read all your other comments and the way you defend a billion dollar corp made me question if you actually have any stake in it. It's not just one or two comments, you consistently went after OP for just exposing what a POS lovable is. I've been your follower for a very very long time to know that you would actually disclose something like that if that were true, but I just can't help but wonder with the aggressive defence for lovable here which I don't think they even deserve 1% of, to be honest. People are building vulnerable apps with them and the right thing to do is call them out on it.
Even after this disclosure I haven't seen any communication from lovable to me as a customer which is just outright disgusting.
[−]legostormtroopr · 2026-11-15 Sun 18:35 UTC ·
link
No, its 2026 - this isn't hacking any more. As long as you say it was AI that scrapped the publicly facing data, its ok and its just an alignment issue.
Edit: The answer (as neathack tells it) is: 2.5% of the sites. The reply was buried below.
Edit: That's 15,9% of all Lovable websites that use Supabase.
Supabase tables also use pagination, and we never downloaded more than the first page.
"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"
You can't know that without pulling the data.
POC -> fine
Actual mass exfiltration -> not fine.
https://gdpr-info.eu/art-4-gdpr/ section 12.
Under the GDPR this was a breach, pure and simple.
One thing they could potentially get in trouble for is Article 14 notification to data subjects (since they have emails), but that's not very heavily enforced. DPA would probably just tell to send the notification.
Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.
The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.
These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.
my second guess was meth, third strict Constitution AIst
This is beyond silly.
There must be a limit to this.... trajectory.
oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
I hope at least that that was a local model. If not you've made things considerably worse.
All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF.
I respect your insistence on proper data handling -- you’re right in doing so -- and we tried to be as careful as possible when conducting the analysis.
Now let’s hold Lovable to the same standard.
I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).
Nothing neathack did was illegal, taking it at face value, of course.
Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.
Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.
Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.
I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue.
As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem.
Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair.
FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.
This is not a self-evident argument, what are you basing this on?
Problem scope is part of problem definition. If you dont know the scope, you dont know the problem.
"What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."
You can't do that without downloading the data first.
I'm really more than a little bit surprised that people here don't seem to know the difference between reporting a vulnerability, which has the potential of being exploited and actually exploiting it.
This phrase is doing a lot of lifting here. Op clearly downloaded far less than is possible.
> Do you realize that at that point in time there is a breach?
As others have said elsewhere, this is a legal opinion and IANAL. Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
> Morally: downloading data, not reading it, then deleting it, then reporting it does not strike me as unethical.
How will you prove you didn't read it?
How will you prove you deleted it and that you did not make a copy?
The company has no option: it is now documented that there is a breach. They will have to report that breach (which if I were them I'd be doing immediately, they have 48 hours to do so). And then they are going to have to make a tough decision: thank you for your time and effort and hope that you really didn't read it and that you didn't copy it or play it safe and file a case against you.
Lots of companies are going to play it safe, if only because their compliance department is not going to want to take the risk of you popping up a few months later with another interesting analysis of data that you shouldn't have had in the first place. That's what makes this so risky, it turns a clear 'good deed' into something that could well end up in court. Morality rarely factors into such situations.
It seems far more likely that Lovable and Supabase won’t consider or report this as a breach, nor will they take any action against the reporter.
I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.
Courts, especially in Germany, are typically not pleased if you take possession of the data.
For instance:
https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...
And quite a few others besides.
As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.
To be fair, I don’t know for certain whether they will.
However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.
I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.
The whole thing was very professional and he was appreciative of our work.
Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.
That said, I think that OP didn't cross the line in relation to each company, but IANAL.
Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?
Put another way, since it's been put on Common Crawl, which presumably follows rules about what to scrape, hasn't Lovable effectively published this data?
> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?
That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.
There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.
The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.
And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.
Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.
(Copied from another comment of mine.)
IANAL, but I think it'd be advisable to seek legal advice if you decide to take door number 2 and collect a corpus of evidence to decide what "the smallest reasonable" is; at least put some serious thought into it — because while I have no reason to suspect that neathack had bad intentions, it doesn't seem likely that it was necessary to collect 159k projects to show the scale of the impact.
He could instead have collected a representative sample, and then extrapolate the true size of the impact. I'm not trained in statistics, so don't know how to calculate the required sample size, but I know it's possible.
Isn't this what you're getting at jacquesm?
You seem to be confusing what feels intuitively wrong with what is actually unlawful. Law doesn't work on feelings. Where are the terms of use? Do they explicitly prohibit this kind of access? How do they define it?
If a website publishes data and provides a public key that automatically allows a browser to retrieve it, good luck arguing that your "security" was bypassed.
Also, OP mentions confidential information. That doesn't automatically make neathack liable. If I publish someone's medical records in a publicly accessible comment here, are you liable for reading them, or am I liable for publishing them on a website with essentially no access controls?
>an actual leak
Got a link? Or "just trust me, bro"?
>I would bet a sizeable amount of money
Unfortunately, my religion prohibits gambling, which we consider degenerate behavior. But by all means, keep the confidence. It would be even more impressive if it came with an actual legal argument.
It was strictly necessary to show the extent of the problem, which will lead to less products leaving their users' data exposed.
It's true that it might lead to legal problems, but there's no doubt that they were morally in the right, and that it's the laws that might punish this that are wrong and harmful.
They downloaded data, didn't (probably) do anything bad with it, and warned everyone about the problem, while in all likelihood many criminals already took it and used it without telling anyone.
You can give people legal advice, but you can't argue that they did anything morally wrong.
Law varies significantly between jurisdictions. You're just blankly claiming it's not illegal. People have been convicted for way less than this, in different countries.
Plus, you could be creating more damages to the company by downloading more data like this, and you're not wearing a white hat when you're creating damage. A white-hat is in and out, without creating damage, with a clean report about the issue so the software provider can patch it.
What are you talking about? Which data? Is this data in the room with us right now?
Pen testers here must be diligent about having a signed contract, or it is way too easy to end up in jail.
While the many posts may have been a bit excessive, jacquesm has a good point if you're looking at it through the lens of US law.
Never forget Aaron Swartz. [1]
[1] https://en.wikipedia.org/wiki/United_States_v._Swartz
As someone who has dealt with vulnerability reports on products before, I'd strongly prefer getting concrete proof of an issue versus "your product came back as positive on our vulnerability scanner^tm" which is 99% of the time going to be a scam or a waste of time.
> On the other hand our big LLM companies Hoover over everything, have access to it, occasionally go rogue with their knowledge and access, but I don’t see many people calling them black hats.
I'll be more than happy to call them criminals and I've warned very publicly about their resetting configuration switches to allow them to pretend that they have your consent to use your data for training purposes.
I’d much rather live in a world where independent researchers can figure out the extent of the issue rather than go “uh oh there might be an issue here, guess we’ll never know the extent of it, let’s trust them to fix it”.
For instance, if I run into a server and I see 'passport.jpg' in a directory listing I could download it to see if it really is a passport. But at that point in time I am flirting with becoming a defendant in a data breach rather than that I'm reporting a possible vulnerability. Sure, you could argue that the site owner might close the hole and then they could downplay that it really was a passport photograph. But I care more about the hole being closed than that I care about the contents of the file, which clearly are not meant to be disclosed based on the filename alone.
Independent researchers that are under contract with the companies they review sometimes have more leeway in what they are allowed to do. But downloading enough data to be able to run statistical analysis using LLMs is turning this into a reportable breach and that is a great way to get this whole thing to backfire, possibly to the point where the OP turns defendant.
the article mentions "we retrieved only parts of the datasets rather than downloading them in full", so a charitable interpretation might be that for each identified source candidate, they spot checked (or had a model spot check) a few individual records to have incontrovertible proof of breach of privacy, and then ran an aggregate count query to gauge the extent of breach. I think that would be fairly in line with "white hat" behavior that's doing the smallest amount of extra work towards a solid proof and clearly not taking the obvious and easy next step of downloading the remainder that would be required for self enrichment. Difficult to argue that there is an intention of malice.
A bad actor would be downloading /all/ the data and disclosing it to no one, and selling it while obscuring the source.
That said I agree that that certainly might fall afoul of the letter of whatever local laws apply, and certainly prosecutors can also be over-zealous in their interpretations. So personally I would never risk doing something that comes up against that line, from a personal risk POV. But idk if it's fair to argue that this is NOT good faith.
Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.
The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."
To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.
Companies respond in different ways to disclosures, by independent researchers and by people under contract. You are absolutely right that in many cases the findings end up in a drawer. This is a real pity. Invariably those will sooner or later be exploited by the bad guys and then the company has a serious problem: they will have to show their homework and if it is found that - at least in Europe - they were aware of the issue but did not take action it may well have the effect of changing a warning into a fine and a fine into a larger one.
Even if the company ends up paying damages, it’s too late for the true victims.
yeah, good question - agreed that probably a lot safer to do this with explicit permission, though like others mentioned the tradeoff is that the company can cover it all up before it's clear just how bad the problem ever was and then say "we fixed a minor issue". I wouldn't risk my neck over that, but some people might I guess.
> To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
To me it sounds like they downloaded one or two records each from 10,560 tables and confirmed that those records contained emails. But you're right, I'm not sure it's very clear from the description.
This said, the reality you seem to describe about pentesting (if I use the word correctly) is very sad to me. I truly respect that security people would go out of their way to make absolutely certain they don't hurt the feeling of the vulnerable website owner so that they don't get sued.
Even after this disclosure I haven't seen any communication from lovable to me as a customer which is just outright disgusting.