Lovable public-project access regression
Lovable confirmed that a backend regression made chat history and source code for public projects potentially accessible to an authenticated Lovable user who had the project link.
- Platform
- Lovable
- Event date
- 2026-02-03
- Disclosure date
- 2026-04-20
- Affected layer
- Project editor data and access control
Confirmed impact
The exposure window ran from February 3 to April 20, 2026. Lovable said private projects and Lovable Cloud were not affected.
Evidence classification
Confirmed real-world incident. High: Lovable published the timeline, affected scope, root cause, and response in a first-party incident report.
Remediation and status
Lovable fixed the regression within two hours of the April 20 report, made current projects private except templates, and changed vulnerability-report triage.
Sentrail analysis
The incident concerns editor/project visibility, not automatic exposure of a deployed website. Builders should still avoid placing secrets in project source and should review project visibility separately from application authorization.
What builders can learn
- Treat project visibility and deployed-site access as separate controls.
- Keep credentials out of browser code and repository history.
- Re-test authorization after backend access-control changes.
Update history
Lovable says the backend regression began.
A researcher reported the issue; Lovable deployed a fix within two hours.
Lovable published its incident response and scope statement.