Scan of 100 Lovable-built apps finds a leaked OpenAI API key

A developer behind the Vespez scanning tool checked 100 apps from Lovable's public showcase: 14 were already offline, and one leaked a live OpenAI API key in its public JavaScript bundle. Average security score was 77/100 and GDPR score 38/100, with 96% missing a Content-Security-Policy header and 92% vulnerable to clickjacking.

• 14 of 100 Lovable apps were unreachable shortly after being showcased
• Average scores: security 77/100, GDPR compliance 38/100
• 96% lack a Content-Security-Policy header, 92% can be embedded by other sites
• 57% have no privacy policy, 63% have no terms of service