Lovable Denies Leak, Blames HackerOne

🔑 Enhanced Key Takeaways

• •The vulnerability stemmed from an Insecure Direct Object Reference (IDOR) flaw within Lovable's API endpoints, which failed to properly validate user authorization tokens when fetching project metadata.
• •HackerOne issued a public statement clarifying that their platform's triage process was not bypassed, noting that Lovable's internal security team had independently closed the report as 'Informative' before the public disclosure occurred.
• •Security researchers highlighted that Lovable's initial response violated standard Coordinated Vulnerability Disclosure (CVD) practices by publicly disparaging the reporter's methodology rather than addressing the underlying architectural flaw.

🛠️ Technical Deep Dive

• •The vulnerability was identified as an IDOR (Insecure Direct Object Reference) vulnerability in the /api/v1/projects/{project_id} endpoint.
• •The API lacked server-side ownership verification, allowing any authenticated user with a valid JWT to access project objects by simply incrementing or guessing the UUID of other users' projects.
• •The platform utilizes a multi-tenant architecture where project data is stored in a shared PostgreSQL instance, and the application layer failed to enforce Row Level Security (RLS) policies for cross-tenant data access.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline