Hacker News

Favorites Setup
Comment by FromTheFirstIn | original | Lovable apps expose passport details and more than 200K private messages
[−]FromTheFirstIn · 2026-11-15 Sun 00:04 UTC · link
It’s really disheartening and disappointing to see how little you can take ownership of Lovable’s part in this. This post doesn’t say “disparate, unconnected apps expose passport details.” These are lovable apps, your apps on your ecosystem. Own it.
[−]jacquesm · 2026-11-15 Sun 00:17 UTC · link
Yes. Lovable is pretty much untouchable for serious businesses going forward until they clean up this mess. And even then.
[−]throwaway27448 · 2026-11-15 Sun 05:19 UTC · link
I'm more worried about the people who may not realize how risky this is.
[−]jacquesm · 2026-11-15 Sun 07:33 UTC · link
Lovable more-or-less presents itself as 'Wordpress for applications'. That comes with a whole pile of responsibilities and a large chunk of their customers may think they are doing a good thing by picking them instead of hiring a dev team.

"Build something Lovable

Bring a new product, internal tool, or entire company to life."

You can't market like that without having the back-end rock solid. There isn't a word about risk or responsibility there, but there are plenty of disclaimers of responsibility in their terms of service and the CISO (active in this thread) does not inspire confidence.

[−]igorandri · 2026-11-15 Sun 12:03 UTC · link
We are investing millions per year into free security tooling. There will be even more changes democratizing security coming out soon, with more features moving to Free/Pro tiers from higher tiers - watch our release announcements. Free and accessible is our core strategy for security features. It's our way to act on the feedback, accept the blame, and find new ways to engage the users and help them fix their apps. I think it's important to be here and engage in the discussion - to learn, share my point of view, and get back to work on securing every app on Lovable with more insights of struggles and issues of builders and the community.
[−]FromTheFirstIn · 2026-11-15 Sun 15:20 UTC · link
Idk why I’m acting like a person read my comment. May as well ask you to write a sonnet for all this addressed what I said