A Replit employee details a critical security flaw in web apps created using AI-powered app builder Lovable that exposes API keys and personal info of app users
THE SCOOP — Lovable, the popular vibe coding app that describes itself as the fastest-growing company in Europe …
SemaforReed Albergotti
Context & Ripple Effects
This report identifies a security failure mode in Lovable-built web apps: exposed API keys and users’ personal information. It matters because Lovable was subsequently characterized as a rapidly growing AI software startup, increasing the potential reach of mistakes embedded in generated applications.
Lovable app creators and their users face immediate exposure risk where generated apps have published secrets or inadequately protected personal data; affected apps require credential rotation and access-control review.
Lovable’s security posture becomes a decision factor for customers evaluating whether its generated code can be deployed without independent security testing.
Second-order effects
Rival AI coding platforms, including Replit, face pressure to make authentication, secret handling, and deployment checks safer by default rather than leaving those controls entirely to novice builders.
Security review becomes an added cost and workflow step for teams using AI app builders, potentially narrowing the speed advantage these tools promise for production-facing apps.
Third-order effects
If recurring findings persist, AI coding platforms will compete on closed-loop application security: generating software, detecting insecure configurations, and driving remediation before deployment.
The category may split between tools suited to rapid prototyping and those trusted for customer-facing production apps, unless platform-level safeguards reduce predictable configuration failures.
The trend: Vibe-coding platforms are moving from code-generation tools toward accountable application-delivery systems, where security defaults and remediation loops are central product capabilities.
Vibe coding empowers new devs—but that means platforms must ship secure defaults. We owe it to the community. Proud of the team for how they handled this vulnerability disclosure.
We're working towards making Lovable the most secure place to build software. These are some of the security improvements we've recently shipped: - Detecting RLS incorrect usage - Deep code security review - Warnings if you put an API key in the chat [More details in thread]
Lovable is now significantly better at building secure apps than a few months ago and this is improving quickly. That being said, we're not yet where we want to be in terms of security and we're committed to keep improving the security posture for all Lovable users.
I don't think people really get what's about to happen because of vibe coding. @johnrushx just reviewed 46! AI coding agents. There's going to be a software explosion and the security industry hasn't caught up. cc @TechmemeChatter https://www.semafor.com/...
Scoop: @mattppal at @Replit filed what is likely a first-of-its-kind “vibe coding” CVE. Details issues with @lovable_dev, a fast-growing vibe coding startup that lets you create web apps with just a prompt. Vibe coding sec is going to be a huge issue https://www.semafor.com/...
wow what's happening? @antonosika must be onto something because Lovable has been bashed or called out by - CEO of Replit - CEO of Bolt (I think was a light nudge?) - and today by v0/vercel lets just build and grow together [image]
🟡 NEW: Lovable, the popular vibe coding app that describes itself as the fastest-growing company in Europe, has failed to fix a critical security flaw, despite being notified about it months ago, according to a new report by an employee at a competitor. https://www.semafor.com/..…
1. Be Replit founder 2. Have a decade-long head start 3. Watch small EU competitor, Lovable, surpass you in usage and making vibe coding secure 4. Copy it 4 weeks later 5. Bash Lovable for not being secure Incredible leadership. https://t.co/...
On March 20th, 2025, my colleague and I discovered a critical vulnerability in Lovable's implementation of Row Level Security (RLS) policies. Applications developed using its platform often lack secure RLS configurations, allowing unauthorized actors to access sensitive user [ima…