Lovable's $5B Vibe Coding Platform Got Breached and They Called It "Intentional Behavior"

Security researcher @weezerOSINT demonstrated that any free Lovable account could access other users' source code, database credentials, AI chat histories, and customer data via a Broken Object Level Authorization (BOLA) flaw. Every project created before November 2025 was exposed. Tens of thousands of developers affected.

Researchers pulled hardcoded Supabase credentials revealing real names and Stripe customer IDs from organizations including Accenture Denmark. This isn't theoretical. This is real customer financial data accessible to anyone with a free account.

Lovable's response made things worse. They initially denied the breach, then described the exposed credentials as "intentional behavior." The security community's reaction was predictable and justified. A 4chan greentext retelling of the saga got 2,200 likes. A separate tweet claiming to show vibe coding erasing "$31B company" infrastructure in 184 seconds hit 1.35 million views.

I've been saying for months that vibe coding's speed-to-ship advantage has a hidden cost, and this is what it looks like. When you generate a full-stack app in minutes, who audits the auth layer? Who checks if your API endpoints enforce object-level authorization? Who verifies that database credentials aren't hardcoded in client-accessible locations?

The BOLA flaw is entry-level security. It's literally item one on the OWASP API Security Top 10. This isn't a sophisticated attack vector. It's the absence of basic access control on API endpoints. And it persisted for months across a platform valued at $5 billion.

The broader pattern is clear. Vibe-coded infrastructure ships fast and breaks in predictable ways. The vulnerabilities aren't exotic. They're the same ones we've been teaching junior developers to avoid for a decade. The difference is that vibe coding generates these vulnerabilities at scale, across thousands of projects simultaneously, with no code review step in the loop.

For builders who've used Lovable or similar vibe coding platforms: audit your infrastructure this week. Check for hardcoded credentials. Verify object-level authorization on every API endpoint. Test whether authenticated users can access other users' resources by manipulating IDs. If you built something with a vibe coding tool before November 2025 and haven't audited it, assume it's vulnerable until proven otherwise.