AI-Coded Apps Leak Sensitive Data Due to Poor Security
RedAccess researchers found over 5,000 AI-coded web applications built with Lovable, Replit, Base44, and Netlify that exposed sensitive corporate and personal data due to default public accessibility and minimal authentication. Exposed information included healthcare records, financial data, strategy documents, and customer conversations, with around 40 percent of the vulnerable apps containing private data.
What happened
RedAccess researchers analyzed thousands of AI-coded web applications created using Lovable, Replit, Base44, and Netlify and found more than 5,000 with virtually no security or authentication. Many apps allowed anyone who found their web URL to access the apps and their data, while others had only trivial barriers such as requiring a visitor to sign in with any email address.
Around 40 percent of the exposed apps contained sensitive data, including medical information, financial data, corporate presentations, strategy documents, and detailed logs of customer conversations with chatbots. Lovable, Replit, Base44, and Netlify all host user web apps on their own domains, making them discoverable through straightforward Google and Bing searches.
Reported impact
Close to 2,000 of the 5,000 publicly accessible apps revealed private data. Exposed information included a hospital's work assignments with doctors' personally identifiable information, a company's detailed ad purchasing information, a firm's go-to-market strategy presentation, a retailer's full logs of chatbot conversations with customers' full names and contact information, a shipping firm's cargo records, and various sales and financial records.
RedAccess found phishing sites built on Lovable impersonating Bank of America, FedEx, Trader Joe's, and McDonald's. The exposed healthcare and financial data may trigger regulatory obligations under HIPAA, UK GDPR, or Brazil's LGPD.
Index analysis
RedAccess discovered 380,000 publicly accessible assets, including applications, databases, and related infrastructure, built with vibe coding tools from Lovable, Base44, and Replit, as well as Netlify, with roughly 5,000 assets containing sensitive corporate information representing about 1.3% of the total.
Governance controls
Privacy settings on several vibe coding platforms make apps publicly accessible unless users manually switch them to private. Lovable said it had begun investigating and removing the phishing sites.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.