alt Hacker NewsIgor here, Head of Security at Lovable. Thanks to the Crissy Field team for their work. The root cause in these apps was insufficent Row-Level Security, which is exactly what our scanning is built to catch. We scan every app automatically before publish and offer a deeper SAST scan, both free for all users. When we flag findings, users can select “Fix” and Lovable will help resolve them. They can also enable auto-fix, which resolves security findings in the background, and block publishing entirely when there are critical findings.
When an app has end users, security is a key part of the product. That’s why we keep investing in making security tools better and easier to use, taking on as much of the security load as we can and fixing more issues automatically.
I personally believe that making security accessible is what leads to making software accessible. We’re committed to both.
You can read more about our approach: https://lovable.dev/blog/find-it-fix-it-ship-it
Replies
How are you going to make sure that none of the data that escaped your control is going to be mis-used?
Have you made an inventory of all of the places where the data ended up?
Have all parties that ended up with copies confirmed the copies are destroyed and had not been passed on?
Have you reported an inadvertent disclosure to the DPA?
You need a framework for sensitive data collection/usage. Auto-fix does not seem like a comprehensive approach.
[dead]
So the approach is:
1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?
2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.
3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?
4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.
5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?
Is this supposed to be a roadmap to security antipatterns?
It's so interesting how you've created a nice ecosystem where you're not responsible for the security problems but at the same time your users are meant to trust you to take care of that. We really need to change the laws around this.
> the people affected here are end users who did not action provided findings.
7500 site operators failing to "action provided findings" seems like a systematic failure on your part and you should accept more responsibility for it. I'm guessing users find the security warnings unclear, confusing, or meaningless. Don't allow users to publish apps if you know they leak private data. Work on educating users and make the apps be built securely the first time.