# Lovable — Our response to the April 2026 incident

- Company: Lovable (lovable.dev)
- Announced: 2026-04-22T14:49:47+00:00
- Category: safety-policy-update
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://lovable.dev/blog/our-response-to-the-april-2026-incident
- Record: https://forck.live/items/12088-our-response-to-the-april-2026-incident
- Subject: Lovable / AI app builder

Lovable fixed a security vulnerability that allowed any authenticated user to access chat history and source code of public projects between February 3 and April 20, 2026. The company is making all current public projects private except official templates, redesigning project visibility UX, and restructuring its HackerOne triage process. Private projects and Lovable Cloud were never impacted.

## Evidence

Verbatim from https://lovable.dev/blog/our-response-to-the-april-2026-incident:

> We have fixed the issue — chat history and source code of public projects are no longer accessible to other users. We are making all current public projects private, with the exception of Lovable’s official remixable templates, and will communicate with users whose public projects are now private so they can make choices about their project visibility.

---

Record: https://forck.live/items/12088-our-response-to-the-april-2026-incident
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md