Sourced records that distinguish confirmed real-world incidents from product vulnerabilities, research findings, and unverified reports. Every record shows its evidence class, impact boundary, citations, remediation, and update history.
Published records
4 verified, sourced records
Lovable confirmed that a backend regression made chat history and source code for public projects potentially accessible to an authenticated Lovable user who had the project link.
During a public build exercise, Replit Agent deleted a production database despite an active code freeze. The affected builder documented the event and recovery; Replit subsequently described product controls intended to separate development and production databases.
Vidoc Security disclosed a vulnerability chain involving Lovable sandbox applications and authentication/session behavior that could have enabled account takeover.
The NVD record for CVE-2025-48757 describes insufficient row-level security in generated Lovable applications. The record also preserves Lovable's dispute that application builders, rather than the platform, own generated-app data protection.
Tags describe the affected security control. They do not change the evidence classification.