Lovable: chat histories of public projects readable
Source: Halborn, April 27, 2026. Written by Lior Aharonov, updated October 3, 2026.
What happened.
Halborn reports that in December 2025 Lovable made projects on its entry tier private by default and patched the related API.
In February 2026 an update to Lovable’s permission management backend re-enabled access to the chats of public projects.
Per Halborn, those chats could contain API keys, credentials, business logic and personal data.
Halborn says the patch first covered new projects and not existing ones, which stayed exposed until after public disclosure in April 2026.
Why it happens.
A builder’s chat is part of the project: it holds the keys you pasted, the logic you explained and sometimes real customer records. When a project is public, people tend to think of the app, not the conversation that built it. A permission change on the platform side can move that line without anyone touching the project.
How to check yours in five minutes.
- Check whether each of your projects is public or private.
- Search your project chats for anything you pasted: keys, passwords, customer data.
- Rotate any key that ever appeared in a chat, and store the new one in Secrets.
- Move real customer data out of prompts; describe its shape instead.
- Run the public scan on the published app.
Check the public side now.
Ten seconds. We read only what any visitor’s browser already sees, and store nothing.
Opens the app security check on this site with your address filled in.
Halborn ↗
Published April 27, 2026. Read it in full; this page summarizes only what it reports.
How it works, in four steps.
Scan
Check the protections any visitor’s browser can see, then run the deeper scan on an app you prove is yours.
Run the scan → 2 · AuditAI-Build Audit
A signed report within 48 hours: what is exposed, what you own, and the order to fix it in.
Ask for the audit → 3 · FixFix
The report’s list, fixed for a set price by a set date. If we miss the target, the next week is on me.
Ask about the fix → 4 · GuardGuard
A weekly automated scan, dependency and model updates, a monthly senior review, and one named person who answers.
Ask about Guard →