From the blog post:

  Using datasets from the open web archive Common Crawl,
  we identified and analyzed 159,041 Lovable projects from
  December 2025 to September 2026. Of these, 34,545 used
  Supabase.
  
  24,664 websites sent database records from Supabase as
  soon as they loaded, without requiring a login or any
  other interaction. That alone is not a security issue:
  the data may be intended for public display. But by
  making additional read-only requests, we were able to
  retrieve more database content. We found records
  containing email addresses in 10,560 tables across 7,403
  of the 24,664 websites (30%).

What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data. Using a confidence threshold of 85%, we found that nearly 4,000 websites leaked such information.

Edit: That's 15,9% of all Lovable websites that use Supabase.

▲ jacquesm an hour ago | parent | next [-]

Don't you think you should have reported this after you established the principle rather than to download more than you needed to do so? Because it looks to me as though you went from 'white hat hacker' to 'quite probably criminal' without a really good reason.

▲

neathack 40 minutes ago | parent | next [-]

I should also mention that the analysis was conducted in collaboration with a lawyer specializing in data protection and ethical hacking.

▲

jacquesm 35 minutes ago | parent [-]

That's an important bit of information that probably should make it into the blog, and I hope you guys made the right call, but I think that that is probably not the case. Best of luck.

oh: "What isn’t mentioned in the analysis is that we ran a System 1 decision model on each dataset to determine whether it contained privacy-sensitive data."

I hope at least that that was a local model. If not you've made things considerably worse.

	▲	neathack 23 minutes ago \| parent [-]
		It’s mentioned in the Handelsblatt article linked in the blog post. Since the lawyer was brought in by the newspaper, we didn’t mention their involvement in the post. All LLM-based analysis was performed using local models, specifically the "elephant-1" model on our local RTX Pro 4000 SFF. I respect your insistence on proper data handling -- you’re right in doing so -- and we tried to be as careful as possible when conducting the analysis. Now let’s hold Lovable to the same standard.

▲

neathack an hour ago | parent | prev | next [-]

What do you mean? This has been disclosed to, and the full dataset has been shared with, Lovable.

▲

44 minutes ago | parent | next [-]

[deleted]

▲

jacquesm an hour ago | parent | prev [-]

What I mean is: you knew it worked before you went and pulled more data, you could have stopped after the first two records, why pull more than you needed to prove that it was possible?

▲

neathack 43 minutes ago | parent [-]

We retrieved only enough data to determine whether it was privacy-sensitive, which could not be reliably assessed from just two records. We did not download any more than that.

Supabase tables also use pagination, and we never downloaded more than the first page.

▲

jacquesm 41 minutes ago | parent [-]

You probably should not have done that. It's one thing to determine that a hole exists, an entirely different one to exploit it to the point that you can do damage assessment on the target.

▲

coldtea 30 minutes ago | parent [-]

Would you prefer someone that didn't intent to report but to exploit the data downloaded everything and the company and you knew fuck all about it?

	▲	jacquesm 29 minutes ago \| parent [-]
		That's not the only choice available.

▲

logotype an hour ago | parent | prev | next [-]

Need to know the full blast radius and severity...

▲

jacquesm 42 minutes ago | parent [-]

Bullshit. That's not for the 'whitehat' to determine.

"We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)"

You can't know that without pulling the data.

▲

liquid_thyme 2 minutes ago | parent | next [-]

Why do you insist on other people following your personal preferences?

	▲	jacquesm a few seconds ago \| parent [-]
		The law is - contrary to your opinion - not a personal preference. POC -> fine Actual mass exfiltration -> not fine.

▲

neathack 2 minutes ago | parent | prev [-]

I mentioned this in another comment, but for completeness: we didn’t actually pull all the data. The number would likely look much worse if we had.

▲

an hour ago | parent | prev | next [-]

[deleted]

▲

moralestapia 14 minutes ago | parent | prev [-]

When it comes to law, you're obviously punching about your weight.

I know you're casual on this, but I wanted to chime in to help you learn a thing or two about this (and to do a service to other who might also be oblivious).

Nothing neathack did was illegal, taking it at face value, of course.

Furthermore, he disclosed it responsibly, didn't publish any confidential data, etc,; actually he published no data at all, other than a statistic.

Criminal law deals with intent, it is clear that neathack's intent here was fueled by goodwill and a research purpose. No judge on the planet will look at this and find wrongdoing on his side.

Also read the room, everyone here has told you the same thing ... just say thanks and move on, man.

	▲	jacquesm 2 minutes ago \| parent [-]
		I don't care about the room. I care about people downloading stuff they have no right to in the name of security, when actually that wasn't strictly necessary to document the fact that there is an issue. As soon as you shift from showing that there is a problem to downloading data to establish the size of the problem you are the problem. Whether he disclosed it responsibly or not is besides the point: you don't get to download a database to prove that it could be done, then you've changed a white hat POC into an actual leak and that is a completely different affair. FWIW this was in Germany against a server in Sweden if I've understood it all correctly and I would bet a sizeable amount of money that I know more about EU data protection laws than you do.

▲ lysace an hour ago | parent | prev [-]

Thanks! So ~2.5%.

	▲	an hour ago \| parent [-]
		[deleted]