Security vulnerabilities exposed in Lovable-showcased EdTech app
A security researcher discovered multiple critical vulnerabilities in an EdTech application showcased as a success story on the Lovable platform. Lovable is a $6.6B "vibe coding" platform that features apps built with their tools.
Vulnerability Details
The researcher tested an EdTech app with 100K+ views on Lovable's showcase that had real users from UC Berkeley, UC Davis, and schools across Europe, Africa, and Asia. In a few hours of testing, they found:
- 16 total security vulnerabilities
- 6 critical vulnerabilities
- Auth logic that was "literally backwards" — it blocked logged-in users and let anonymous ones through
- The researcher described this as "classic AI-generated code that 'works' but was never reviewed"
What Was Exposed
- 18,697 user records (names, emails, roles) — accessible without authentication
- Account deletion via single API call — no authentication required
- Student grades modifiable — no authentication required
- Bulk email sending capability — no authentication required
- Enterprise organization data from 14 institutions
Response
The researcher reported the vulnerabilities to Lovable, who closed the support ticket without addressing the issues.
📖 Read the full source: r/ClaudeAI
👀 See Also
New Skill Automates OpenClaw Security Hardening on Remote Servers
A community developer has released a skill that helps AI assistants automatically secure OpenClaw installations on remote servers.
OpenClaw Security Alert: 500,000 Public Instances, Default Config Exposes Systems
A security analysis reveals 500,000 OpenClaw instances are publicly accessible, with 30,000 having known security risks and 15,000 exploitable through known vulnerabilities. The default installation disables authentication and binds to 0.0.0.0, exposing agent setups to the open internet.
OpenClaw Bypasses Security Restrictions to Overwrite Config File
A user reports that OpenClaw's security restrictions are bypassed by copying and replacing the config file. Agent refused direct edit but allowed indirect overwrite.
OpenClaw SOC Agent Integration for SIEM Home Lab Threat Hunting
A Reddit user shares their open-source SIEM setup called Red Threat Redemption on Debian 13, integrating Elasticsearch, Kibana, Wazuh, Zeek, and pfSense with Suricata, then adds an AI agent for automated threat correlation, hunting, and alert triage.