Yes, absolutely. And the common element here strongly points at Lovable setting things up in such a way that this kind of vulnerability can easily be the result of using their product. I really don't buy their position that they have no responsibility here, as far as I can see Supabase, Lovable and the customers of Lovable all failed to do right by the data subjects. Every one of those websites whose data was downloaded effectively has a reportable breach on their hands and Lovable and Supabase have one as well.

If they wipe this under the carpet the lot of them could be in really hot water if a regulator finds out. I tried asking the CISO of Lovable up-thread about this but they never answered, and I really think those questions need to be answered, and need to be answered publicly.