Hacker News

Favorites Setup
Comment by unclebucknasty | original | Lovable apps expose passport details and more than 200K private messages
[−]unclebucknasty · 2026-11-15 Sun 00:43 UTC · link
As with many gray areas in the law, this all likely comes down to a reasonableness test. New laws may be needed but, to the fullest extent possible, these issues will be framed through the lens of existing law—e.g. product liability. And, once tested in court, these will likely lead to new precedents around existing laws.

For instance, questions will arise as to whether it's reasonable for Lovable to hand this kind of power over to a customer. And, if their software is capable of detecting vulnerabilities, but allows the customer to proceed, is that reasonably responsible behavior on Lovable's part?

Then, there are tests regarding what their customers should reasonably be expected to understand. For instance, it might be tempting to compare this to gun liability laws, wherein manufacturers can disclaim responsibility if their guns are mishandled. But, here, what is the level of knowledge required to fully understand the risks—including the risk/cost of breaking a production build? And, is it reasonable that their customer should be expected to understand?

So, this even comes down to their marketing. If they are actively selling to novice customers, with the pitch that no expertise is required, then customers may argue that they were "set up", and it may prove very difficult to pin the blame on those customers.

Attorneys would likely argue that Lovable can't have it both ways—selling to amateurs, then blaming their customers for being amateurs.

Disclaimer: I once played a lawyer in a 7th grade mock court. Oh, and my company was once sued.

[−]neathack · 2026-11-15 Sun 01:01 UTC · link
Thank you for your very thoughtful comment!

Although already mentioned in the research report, the following links show that Lovable explicitly targets non-technical customers, stating that no technical expertise is required:

https://lovable.dev/blog/what-is-vibe-coding

  Makes software development accessible – Non-developers can now build
  functional apps without needing years of coding experience.
https://lovable.dev/blog/2025-01-30-why-non-tech-founders-no...

  This fundamentally changes the startup equation:
  - No need to convince a developer to join before validation.
  - No delays from back-and-forth translation between business and tech.
  - Immediate product iterations, turning feedback into new features
    within hours.
  
  With Lovable, non-technical founders cut months of friction and focus
  entirely on product-market fit, rather than struggling to find a
  development team.
https://lovable.dev/founders

  No, you don't need to know how to code. Build by describing what
  you want. But if you know code, you can dive into code mode anytime.
https://lovable.dev/vibecoding

  All you need to kick off your vibe coding journey is an AI-powered
  no-code builder (like Lovable). As long as you can describe what
  you're looking to build, you can build it.
[−]fn-mote · 2026-11-15 Sun 01:04 UTC · link
> including the risk/cost of breaking a production build

If the customer is deploying (“to prod”) they need to know enough to assess their own risks of breaking their software.

I’d want to see the text of the warning to customers before having an opinion on how in/sufficient it was.