Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

https://www.theregister.com/2026/02/27/lovable_app_vulnerabilities/

by nottorp • 5 months ago

140 35 5 months ago

carlgreene2• 5 months ago

The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case.

There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.

yoyohello13• 5 months ago

Yeah, my trust for new open source projects is in the toilet. Hopefully we will eventually start taking security seriously again after the vibe code gold rush.

esseph• 5 months ago

Hopefully we will eventually start taking security seriously again after the vibe code gold rush.

Companies don't take security seriously now (and predating vibe coding)

dizhn3• 5 months ago

This applies to all software not just open source.

ctoth2• 5 months ago

I'm sorry, what?

Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things

When was this? What world? Did I skip worldlines? Is this a new Universe?

The world I remember is that anybody could write a program and put it on the Internet. Is this not the world you remember?

Further, when those engineers were "trained" ... were there no data breaches before 2022?

carlgreene2• 5 months ago

Of course there were. Don't be pedantic. Anybody could write a program and put it on the internet. But to get a reasonably polished version with decent features and an enjoyable enough UX for someone to sign up and even pay money more, it generally took people who kind of knew what they were doing.

Of course shortcuts were taken. They always were and always will be. But don't try to compare shipping software today to even just 3 years ago.

627467• 5 months ago

The frequency with which I see contemporary apps updating (sometimes multiple times a day) says there's a change in culture that also makes professionals prone to mistakes.

I get that we'll never ship a perfect release, but if you have to push fixes once a day it seems you've lost perspective.

Vibe coding slopiness is more acceptable now because we've lowered our standards

cosmic_cheese• 5 months ago

Devs' newfound ability to patch on the fly is absolutely being overleveraged. It's a wonderful capability to have that can do wonders in terms of disaster mitigation, but it's clearly become a crutch and has resulted in a situation where software has become a horrific amalgamation of haphazardly-developed panic-patches, taking the classic "ball of mud" problem and putting it into overdrive.

general_reveal• 5 months ago

The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not

Hah. Advert of the year. Can’t really tell the difference anymore huh …

ch4s32• 5 months ago

I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access.

I'm interested to hear how other people approach this.

ctoth2• 5 months ago

Same way you handle preserving any other property you want to preserve while "vibecoding" -- ensure tests capture it, ensure the tests can't be skipped. It really is this simple.

s_ting765• 5 months ago

Ask the LLM to create for you a POC for the vulnerability you have in mind. Last time I did this I had to repeatedly make a promise to the LLM that it was for educational purposes as it assumed this information is "dangerous".

ch4s32• 5 months ago

This is actually pretty interesting. I guess I knew you could do this offensively but it didn’t occur to me to use it OWASP style to test my own work.

adampunk• 5 months ago

So the problem I'm having is I don't know what I'm doing vis a vis security, so I can't audit my own understanding by just sitting in a chair, but here's what I've been doing.

I'm building a desktop app that has has authentication needs because we need to connect our internal agents and also allow the user to connect theirs. We pay for our agents, the user pays for theirs (or pays us to use ours etc.). These are, relatively speaking, VERY SIMPLE PROBLEMS, nevertheless agents are happy to consume and leak secrets, or break things in much stranger ways, like hooking the wrong agent up to the wrong auth which would have charged a user for our API calls. That seemed very unlikely to me until I saw it.

So far what has "worked" (made me feel less anxious, aside from the niggling worry that this is theater) is: 1. Having a really strong and correct understanding of our data flows. That's not about security per se so at least that I can be ok at it. This allows me to... 2. Be aggressive and paranoid about not doing it at all, if it can be helped. Where I actually handle authentication is as minimal as possible (one should have some reasonable way to prove that to yourself). Done right the space is small enough to reason about.

How do I do 1 & 2 while not knowing anything? Painfully and slowly and by reading. The web agents are good if you're honest about your level of knowledge and you ask for help in terms of sources to read. It's much more effective than googling. Ask, read what the agents say, press them for good recommendations for YOU to read, not anyone. Then go out and read those sources. Have I learned enough to supervise a frontier model? No. Absolutely not. Am I doing it anyway? Yes.

julianlam• 5 months ago

One example of this was a malformed authentication function. The AI that vibe-coded the Supabase backend, which uses remote procedure calls, implemented it with flawed access control logic, essentially blocking authenticated users and allowing access to unauthenticated users.

Actually sounds like a typical mistake a human developer would make. Forget a `!` or get confused for a second about whether you want true or false returned, and the logic flips.

The difference is a human is more likely to actually test the output of the change.

firefoxd• 5 months ago

Lovable is marketed to non developers, so their core users wouldn't understand a security flow if it flashed red. A lot of my non dev friends were posting their cool new apps they built on LinkedIn last year [0]. Several were made on lovable. It's not on their users to understand these flaws

The apps all look the same with a different color palette, and makes for an engaging AI post on LinkedIn. Now they are mostly abandoned, waiting for the subscription to expire... and their personal data to get exposed I guess

[0] https://idiallo.com/blog/my-non-programmer-friends-built-app...

alfiedotwtf• 5 months ago

Developers with decades of experience still make basic security holes. The general public are screwed once they start hosting their own apps and serving on the Internet.

cube00• 5 months ago

There's something so innocent about the early days when even Microsoft thought we'd be running Personal Web Servers and hosting our own websites in a peer-to-peer fashion.

Although cynically, in 1996 Microsoft would probably tell you anything you wanted to hear if it got you using Internet Explorer.

The Personal Web Server is ideal for intranets, homes, schools, small business workgroups and anyone who wants to set up a personal Web server.

https://news.microsoft.com/source/1996/10/24/microsoft-annou...

geraneum• 5 months ago

Developers with decades of experience still make basic security holes.

You see this type of template response copy pasted basically under any post/comment of this kind.

I think at the end of the day we’ll be able to look back and see what/who fared better, based on actual data.

melecas• 5 months ago

Vibe coding democratized shipping without democratizing the accountability. The 18,000 users absorbed the downside of a risk they didn't know they were taking.

andersmurphy• 5 months ago

With the power of LLMs anyone can make and sell foot guns.

shimman• 5 months ago

I don't think you know what democracy means, democracy means that users can reject poorly made apps. If you can't reject or destroy something, it's not a democratic process.

Having someone dump shitty wares onto the public is only democracy if you think being held unaccountable as democratic.

SetTheorist• 5 months ago

One of the meanings of the word "democratization" is "the action of making something accessible to everyone", which is clearly the sense meant here.

recursivedoubts• 5 months ago

I continue to maintain that the best metaphor for the current situation in software development is "The Sorcerers Apprentice" in Fantasia:

https://www.youtube.com/watch?v=m-W8vUXRfxU

aitchnyu• 5 months ago

One dev of a Lovable competitor pointed me to the rules thats supposed to ensure queries are limited to that user's data. This seems like "pretty please?" to my amateur eyes.

https://github.com/dyad-sh/dyad/blob/de2cc2b48f2c8bfa401608c...

joeyguerra• 5 months ago

It had 18k users?!

Bombthecat• 5 months ago

AI is perfect for plugins though, for products where security is a stones issue or you don't care ( I created a few modules for foundry vtt for example)

t312227• 5 months ago

surprised pikachu face ... what did we expect!? ;)

drunken_thor• 5 months ago

This is a prime example of how lazy vibe coding makes people. Even if they were not technical, some of these bugs would have been caught if they just went through the behaviour by hand at least once. Not an ounce of QA just generate and ship.

Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

Related Stories