> [...] nor will they take any action against the reporter.
To be fair, I don’t know for certain whether they will.
However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.
I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.
The whole thing was very professional and he was appreciative of our work.
Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.
To be fair, I don’t know for certain whether they will.
However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.
I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.
The whole thing was very professional and he was appreciative of our work.
Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.
That said, I think that OP didn't cross the line in relation to each company, but IANAL.