Lovable Leaks Source Code: The $6.6B BOLA Vulnerability

You type a prompt. The AI generates a full-stack React application with a connected database. You deploy it with one click. That is the promise of Lovable, an AI app builder with 8 million users and a $6.6 billion valuation.

But abstraction comes with a cost.

The Breach Nobody Owned

A security researcher operating as @weezerOSINT recently proved that anyone could access a Lovable user's source code, database credentials, and AI chat histories. They did not use an advanced zero-day exploit. They created a brand new free account and made five basic API calls.

This exposure leaked real user data. Names, job titles, and LinkedIn profiles from apps built on the platform were laid completely bare.

The worst part is not the vulnerability itself. It is how the company handled it.

48 Days of Denial

The researcher reported the vulnerability to Lovable on March 3. The company ignored it for 48 days.

When the exploit finally went public on Twitter, Lovable panicked. Their story changed three times in under 24 hours:

1. First claim: They did not suffer a data breach. They attempted to spin the exposure as "intentional behavior" and blamed "unclear documentation."
2. Developer pushback: The community immediately called out the absurdity of classifying leaked database credentials as a documentation issue.
3. Blame shift: Lovable shifted responsibility to HackerOne, their bug bounty partner, claiming they misunderstood the severity and closed the ticket as intended behavior.
4. Finally, the truth: The company admitted a backend permissions rewrite accidentally disabled access controls. Public projects created before the patch were fully exposed.

This pattern tells you everything. When a $6.6 billion platform fumbles for 48 days, then pivots through three different narratives instead of owning the mistake, you know something is structurally broken.

Understanding BOLA: The Most Critical API Flaw

The vulnerability at the heart of this is called Broken Object Level Authorization (BOLA). It is consistently ranked as the most critical API security risk in the industry by OWASP.

BOLA happens when an API endpoint takes an ID from a client request and returns data without checking if the user actually owns that data.

The Vulnerable Pattern

Here is what a broken endpoint looks like in code:

# Vulnerable BOLA Endpoint
@app.get("/api/projects/{project_id}")
async def get_project(project_id: int, user: User = Depends(get_current_user)):
    # Flaw: We check if the user is logged in, but not if they own the project.
    project = db.query(Project).filter(Project.id == project_id).first()
    return project

If you log in and request /api/projects/123, you get your project. But if you change the request to , the server just hands over the next user's project. No brute-forcing is required. You just change an ID in the network tab of your browser.