How many of the 159k analyzed sites leaked private data?

Edit: The answer is: 2.5% of the sites. The reply was buried below.

▲ neathack an hour ago | parent [-]

From the blog post:

  Using datasets from the open web archive Common Crawl,
  we identified and analyzed 159,041 Lovable projects from
  December 2025 to September 2026. Of these, 34,545 used
  Supabase.
  
  24,664 websites sent database records from Supabase as
  soon as they loaded, without requiring a login or any
  other interaction. That alone is not a security issue:
  the data may be intended for public display. But by
  making additional read-only requests, we were able to
  retrieve more database content. We found records
  containing email addresses in 10,560 tables across 7,403
  of the 24,664 websites (30%).

What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information.

Edit: That's 15,9% of all Lovable websites that use Supabase.

▲

jacquesm 44 minutes ago | parent | next [-]

Don't you think you should have reported this after you established the principle rather than to download more than you needed to do so? Because it looks to me as though you went from 'white hat hacker' to 'quite probably criminal' without a really good reason.

▲

neathack 24 minutes ago | parent | next [-]

I should also mention that the analysis was conducted in collaboration with a lawyer specializing in data protection and ethical hacking.

▲

jacquesm 19 minutes ago | parent [-]

That's an important bit of information that probably should make it into the blog, and I hope you guys made the right call, but I think that that is probably not the case. Best of luck.

oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."

I hope at least that that was a local model. If not you've made things considerably worse.

	▲	neathack 6 minutes ago \| parent [-]
		It’s mentioned in the Handelsblatt article linked in the blog post. Since the lawyer was brought in by the newspaper, we didn’t mention their involvement in the post. All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF. I respect your insistence on proper data handling -- you’re right in doing so -- and we tried to be as careful as possible when conducting the analysis. Now let’s hold Lovable to the same standard.

▲

neathack 40 minutes ago | parent | prev | next [-]

What do you mean? This has been disclosed to, and the full dataset has been shared with, Lovable.

▲

28 minutes ago | parent | next [-]

[deleted]

▲

jacquesm 35 minutes ago | parent | prev [-]

What I mean is: you knew it worked before you went and pulled more data, you could have stopped after the first two records, why pull more than you needed to prove that it was possible?

▲

neathack 27 minutes ago | parent [-]

We retrieved only enough data to determine whether it was privacy-sensitive, which could not be reliably assessed from just two records. We did not download any more than that.

Supabase tables also use pagination, and we never downloaded more than the first page.

▲

jacquesm 25 minutes ago | parent [-]

You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.

▲

coldtea 14 minutes ago | parent [-]

Would you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it?

	▲	jacquesm 13 minutes ago \| parent [-]
		That's not the only choice available.

▲

logotype 30 minutes ago | parent | prev | next [-]

Need to know the full blast radius and severity...

	▲	jacquesm 26 minutes ago \| parent [-]
		Bullshit. That's not for the 'whitehat' to determine. "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)" You can't know that without pulling the data.

▲

38 minutes ago | parent | prev [-]

[deleted]

▲

lysace an hour ago | parent | prev [-]

Thanks! So ~2.5%.

	▲	an hour ago \| parent [-]
		[deleted]