These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.
These are all separate code bases with different owners, different database designs and different security frameworks. The only thing they have in common is being built by AI using loveable (which sells itself as allowing anyone to build web apps but arguably doesn't do enough help the user make those apps secure)
If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.