From the source
From the source
Lovable fixes a public-project data exposure and tightens its vulnerability triage process.
Lovable fixed a security vulnerability that allowed any authenticated user to access chat history and source code of public projects between February 3 and April 20, 2026.
The company is making all current public projects private except official templates, redesigning project visibility UX, and restructuring its HackerOne triage process.
Private projects and Lovable Cloud were never impacted.
From the source
We have fixed the issue — chat history and source code of public projects are no longer accessible to other users. We are making all current public projects private, with the exception of Lovable’s official remixable templates, and will communicate with users whose public projects are now private so they can make choices about their project visibility.
lovable.dev
