Lovable AI App Builder Reportedly Exposes Thousands of Projects Data via API Flaw

A Broken Object Level Authorization (BOLA) flaw in Lovable's API (notably the GetProjectMessagesOutputBody endpoint) is reportedly returning full project message histories, AI reasoning logs, and stored secrets to unauthenticated/free-tier accounts for projects created before November 2025. Researchers found exposed Supabase credentials, source code, and real user records—including data tied to nonprofit and corporate accounts—while the platform has only partially remediated new projects, leaving legacy projects at risk; users are advised to rotate keys and secrets and audit affected projects.