[−]hn_throwaway_99 · 2026-11-14 Sat 19:00 UTC ·
link
Folks are blaming AI, and that's certainly part of it (folks without knowledge and experience can now build polished apps, though there were still plenty of "WTF" security breaches before AI), but I feel like the only thing that can fix this are real, stiff liability consequences.
The defects listed in this report didn't require some complicated 0-day exploit chain - they were just sensitive data stored without any authentication at all, in a database that anyone with Internet access can view. In other words, it would be the equivalent of a company like Public Storage leaving all of its storage units with no locks on them at all.
Affected users should be able to sue for a lot in these basic security failures. And obviously for many of these small websites, the potential damages would quickly bankrupt the site owners, but that's the point. People would think a lot more carefully about how they protect sensitive data if there were real negative consequences for their failures.
I agree that AI is not necessarily at the core of the problem.
To me, the issue is Lovable’s borderline reckless marketing: repeatedly claiming that “everyone” can build a website “without any technical knowledge” (verbatim from their website), while disclaiming all liability for bugs in their terms and placing responsibility for security on their customers.
Customers who hear day in, day out that “software is solved” and buy into Lovable’s narrative may simply have no idea that they could face substantial fines for privacy violations.
EU citizens can sue. It's not easy in every EU country, and ot differs whether you will be compensated.
But in all cases, under GDPR, the one having the data breach is required to act. If they fail, there's steep fines, often proportional to your revenue. It will hurt the business.
IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, is clear and not the hosters' responsibility. That hoster does have an obligation to provide good tooling (i.e. ssh, not telnet, sftp, not ftp) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories). Or else can be held (partially) responsible for breaches.
Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.
Sorry, I was flippant in my previous comment -- they SAY they can’t be sued. I’d hope those “non-technical founders” wouldn’t be left out in the cold and that Lovable would be held liable as well.
That's not a run race. They are a processor and this definitely was on their watch. Both controller (the website owner) and the processor and sub-processor (Lovable, Supabase) all have pretty clear joint and individual responsibilities here and all of them have failed to greater or lesser degree. The Controller may even be in the better position of the three.
The defects listed in this report didn't require some complicated 0-day exploit chain - they were just sensitive data stored without any authentication at all, in a database that anyone with Internet access can view. In other words, it would be the equivalent of a company like Public Storage leaving all of its storage units with no locks on them at all.
Affected users should be able to sue for a lot in these basic security failures. And obviously for many of these small websites, the potential damages would quickly bankrupt the site owners, but that's the point. People would think a lot more carefully about how they protect sensitive data if there were real negative consequences for their failures.
To me, the issue is Lovable’s borderline reckless marketing: repeatedly claiming that “everyone” can build a website “without any technical knowledge” (verbatim from their website), while disclaiming all liability for bugs in their terms and placing responsibility for security on their customers.
Customers who hear day in, day out that “software is solved” and buy into Lovable’s narrative may simply have no idea that they could face substantial fines for privacy violations.
But in all cases, under GDPR, the one having the data breach is required to act. If they fail, there's steep fines, often proportional to your revenue. It will hurt the business.
E.g. here's what a ditch citizen can do and expect https://www.autoriteitpersoonsgegevens.nl/en/themes/security...
IANAL, but I've had several hosting companies. And while most situations where a customers' site is hacked and/or their data leaked, is clear and not the hosters' responsibility. That hoster does have an obligation to provide good tooling (i.e. ssh, not telnet, sftp, not ftp) and to promote good behaviour (i.e. not allowing the backup system to write the backups to public hosted directories). Or else can be held (partially) responsible for breaches.
Lovable has a responsibility, and, as you pointed out in your article, their proposition of "building apps without technical knowledge" (my words), might make theirs to be more than just putting lines in a EULA to waver that responsibility.