Vercel + Lovable Security Breaches
Quick one this week — but an important one.
Two platforms that basically every vibe coder and indie builder uses just had major security incidents. If you have projects on Vercel or Lovable, there are specific things you need to do today.
This isn't fear-mongering. It's a checklist. Let's get into it.
🔴 INCIDENT #1: Vercel Was Breached (April 19, 2026)
Vercel — the platform most of us deploy our apps on — confirmed a security breach this week.
Here's what happened: a third-party AI tool called Context.ai that was used internally by a Vercel employee had its Google OAuth app compromised. The attacker used that access to get into the employee's Google Workspace account, then pivoted from there into Vercel's internal systems.
Once inside, they were able to read customer environment variables — but only the ones not marked as "sensitive." That means API keys, database credentials, signing tokens, anything that was stored without the sensitive flag is potentially in someone else's hands right now.
Vercel's CEO Guillermo Rauch confirmed the attack was highly sophisticated and "likely AI-accelerated." The attacker moved fast and knew exactly where to look.
A hacker group claiming to be ShinyHunters posted on a breach forum saying they have Vercel's data and are selling it for $2 million. That's unverified — but the breach itself is confirmed.
✅ What to do right now if you use Vercel:
- Go to your Vercel dashboard → Environment Variables
- Rotate every API key, database password, and token that was NOT marked as "sensitive" — assume they're already compromised
- After rotating, mark all secrets as "Sensitive" going forward so they're encrypted at rest
- Redeploy your projects — rotating the variable alone doesn't update live deployments
- If your team uses Google Workspace, check for a connected OAuth app with ID:
110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com— if it's there, revoke it immediately
🟠 INCIDENT #2: The Lovable Security Flaw (CVE-2025-48757)
This one is older but still unresolved for many builders — and it directly affects your users, not just your credentials.
Lovable's AI was generating apps with broken database security configs by default. Specifically, it wasn't properly setting up Row-Level Security (RLS) in Supabase — the database layer that controls who can access what data.
A researcher scanned 1,645 apps built on Lovable. 170 of them were completely open. No login required. Anyone could read your users' names, emails, payment info, API keys — everything. One app alone had 18,000 user records just sitting there.
When the researcher reported it? Lovable's official response was: "It's the user's responsibility."
They launched a "security scanner" that only checked whether RLS existed — not whether it was actually configured correctly. False sense of security.
✅ What to do right now if you use Lovable:
- Run Vibe-Scanner (free, open source) against your projects → github.com/SymbioticSec/vibe-scanner
- In your Supabase dashboard, go to Authentication → Policies and verify Row Level Security is enabled AND configured on every table
- Never assume Lovable's security scan means you're safe — it doesn't test whether the policies actually work
- If your app has real users with real data, get a developer to manually audit your Supabase RLS before you go any further
- For future projects: use Lovable for the frontend, handle your backend separately with proper security controls
The Big Picture 🧠
These two incidents aren't random bad luck. They're a pattern.
The tools we use to build fast — vibe coding platforms, AI-generated backends, third-party OAuth integrations — all have one thing in common: they abstract away complexity. And sometimes, hidden inside that complexity, is a security assumption that was never validated.
Vercel assumed non-sensitive env vars were actually non-sensitive. Lovable assumed users would catch their own security flaws. Both assumptions were wrong.
Moving fast is good. Shipping without checking is how you expose your users.
15 minutes this week going through those checklists is worth it.
See you next week!