How do you square this with the news article being published on November 2nd, and referring to prior attempts to report going back to August?

It seems far more likely that Lovable and Supabase won’t consider or report this as a breach, nor will they take any action against the reporter.

> [...] nor will they take any action against the reporter.

To be fair, I don’t know for certain whether they will.

However, Lovable was informed weeks in advance. They provided an official statement confirming the findings, which is included in the Handelsblatt article. At no point did they ask us to delay publication or threaten legal action. I can assure you that we would not have published the findings otherwise.

I also want to point out that I contacted Lovable’s head of security directly and shared the results of the analysis: websites, table names, record counts, and an LLM-generated “privacy sensitivity score.” No actual records were shared, as they had already been deleted. He was very cooperative and said his team would review the information and contact the affected customers.

The whole thing was very professional and he was appreciative of our work.

Edit: I see that Igor (Lovable's head of security) has commented in this thread as well.

That may well be so. But that doesn't mean this is how you do it.

I draw the line at downloading data beyond what is required to prove there is an issue and I think you probably should cross that line only when you either have a contract with the company you are researching or if you have a lawyer that you pay that has signed off on what you are about to do. Anything less than that an - imnsho - you are playing the lottery.

Courts, especially in Germany, are typically not pleased if you take possession of the data.

For instance:

https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

And quite a few others besides.