Lovable's API didn't check whether an account calling it actually owned the project it was asking about — a broken object-level authorization (BOLA) bug. Security researcher @weezerOSINT found that five API calls from a brand-new free account were enough to reach another user's profile, their public projects, that project's source code, and the Supabase database credentials hardcoded inside it. AI chat histories on public projects were exposed too.

What the source says

The Register reports that the researcher filed the bug through Lovable's HackerOne bug-bounty program on March 3, 2026.…