While you are technically correct, in practice the democratizing of a tool that can be consequential in leaking your private information should come with stronger safeguards and educational opportunities for those who aren’t well versed in technology.
Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.
Moving too fast and putting the onus at the user is a bit shady.
You're sharing a perfectly valid opinion that I happen to agree with. However, you did so in reply to a very specific question — someone asking why jacquesm (a well-known poster on HN) — considers the actions described in the article a data breach rather than merely security testing. Your comment had nothing to do with that. That's all!
Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.
Moving too fast and putting the onus at the user is a bit shady.
My point was to say how AI tools can quickly build insecure software systems.
Am I wrong that shipping a key publicly in the client side is not something a tool should try to check for?