> [...] nor will they take any action against the reporter.

To be fair, I don’t know for certain whether they will.

However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.

I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.

The whole thing was very professional and he was appreciative of our work.

Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.

That may well be so. But that doesn't mean this is how you do it.

I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.

Courts, especially in Germany, are typically not pleased if you take possession of the data.

For instance:

https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

And quite a few others besides.

To clarify: no PII leaked from Lovable apps ended up in Common Crawl. Common Crawl was used solely to identify Lovable apps—not to retrieve leaked data. It does not store XHR responses, which are how data is retrieved from Supabase.

(Copied from another comment of mine.)

If you're researching I would stop at the minimum required to determine that there is an issue, maybe you have a lawyer that will tell you different. This being Germany I would play it very safe. From the company's perspective there is no difference between downloading 1, 10 or 50,000 records to prove the point, though they likely will respond a bit quicker if you tell them you could download tens of thousands of records.

> Another question: I'm not sure if you noticed, but he obtained it from a 3rd party called Common Crawl (https://commoncrawl.org/) which "maintains a free, open repository of web crawl data that can be used by anyone." Doesn't this imply the damage is already done, since the data's been made available to _anyone_ at this point?

That is an interesting question. Common crawl could - and should - have realized they have no business hoovering this up and they may well be found to be negligent in how they set up their crawler. Note that the title makes it very clear that it is patently obvious that this data was not meant to be published 'passport details and more than 200K private messages' leaves very little to the imagination.

There is a massive difference between an unintentional disclosure and an intentional one. You can turn the one into the other and end up with a real problem.

The best way to handle these cases is to try to look through the eyes of the data subjects and then to do what is in their best interest. That will most likely guide you to what is safe to do without spending a fortune on legal opinions trying to find out where that bright line sits.

And that immediately illustrates the problem: the fewer people that have copies of this data the better, so by making one more copy - even though there already exists one that should not be publicly accessible - you are making the problem worse.

Common crawl, Lovable, Supabase and the OP all could do better with respect to the interests of the data subjects. OP at least realized there was a problem.