Lovable AI platform chat histories and code exposed via public API settings
A security researcher reportedly discovered that users' projects on the Lovable AI app-building platform, containing source code, credentials, and chat histories, were accessible via public API settings. Lovable acknowledged unclear documentation but disputed that this constituted a data breach, stating code visibility was intentional design.
What happened
A researcher with handle 'impulsive' reported that users' active projects on the Lovable platform, including full source code, database credentials, customer records, and AI chat histories, were accessible through five API calls from a free account.
Lovable acknowledged that its documentation around what 'public' meant for project visibility had been unclear, and that chat messages in public projects used to be visible but are now no longer accessible. The company said code visibility in public projects was intentional and consistent with product design.
Reported impact
The researcher was able to access another developer's active project including its full source code, database credentials, customer records, AI chat histories and related data.
Lovable stated that enterprise customers have not been able to set new projects to public since May 25, 2025.
Index analysis
The exposure resulted from unclear documentation around public settings rather than a security breach according to the company, though the researcher demonstrated the data was accessible through routine API calls without authorization from the account owner.
Governance controls
Lovable made chat histories in public projects no longer visible in response to the disclosure. The company stated that code visibility in public projects remained intentional design behavior.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.