Lovable website builder accused of critical security flaws enabling phishing
Lovable, an AI website builder, has been reportedly accused of critical security vulnerabilities that exposed user data and allowed easy creation of phishing scams. Researchers found the platform to be the easiest among major AI tools for generating credential-theft campaigns without adequate safeguards.
What happened
Lovable has been accused of failing to address critical security flaws despite repeated notifications, with reports revealing that hundreds of apps built using the platform exposed sensitive user data including names, email addresses, financial information, and secret API keys due to misconfigured databases and weak security controls.
Cybersecurity researchers found that Lovable is the easiest tool among major AI platforms to exploit for creating phishing scams, allowing even novice attackers to automate the creation of convincing fake login pages and credential-stealing campaigns.
Reported impact
The vulnerabilities open the door to mass phishing, credential theft, and significant financial and reputational harm for users and businesses that rely on Lovable-generated sites.
Index analysis
The root cause lies in Lovable's design as a no-code/low-code AI platform aimed at non-technical users, which prioritises ease of use and rapid deployment over robust security and moderation.
Lovable lacks effective guardrails and prompt-level moderation, making it easy for bad actors to jailbreak the system and automate malicious activities.
Governance controls
The platform's AI models generate code without sufficient scrutiny of how it will be used or implemented, and inexperienced users may not understand the importance of secure database configurations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.