Skip to content
BuildThenTestedSee packages
HighDeploy and config

Builder project set to public

Everything you and the assistant wrote to each other, including pasted keys, customer details and unpublished code, can be read and copied by strangers on the same platform. How code reaches production and how the server is configured. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

Project settings
  Project access:   Public        (anyone on the platform can view and remix)
  Website access:   Public        (anyone with the link can visit)

Chat history (visible with the project):
  "Here is my Stripe key sk_live_... please add it to the checkout"
A builder project whose editor, source code and chat history are visible to other users of the platform, with a secret pasted into the conversation.

What happens

Everything you and the assistant wrote to each other, including pasted keys, customer details and unpublished code, can be read and copied by strangers on the same platform.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.

  • 2026-02-03 to 2026-04-20 Exposure window
  • 2026-02-22 First HackerOne report
  • about 2 hours Time from public report to fix

Apr 2026 · Lovable · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. Open the project in your builder and find the settings or share dialog. Look for two separate controls: one for who can open the project in the editor, one for who can visit the published site.
  2. Read the project access value; treat Public, Anyone with the link or Remixable as exposed.
  3. Scroll back through the project chat and search for sk_live, eyJ, password and @ to see what a reader would find.
  4. A bad result is project access set to Public while the chat or code contains a credential, or a project you cannot remember making public that shows as Public.

What we check

We review project visibility across every project in your workspace, scan the exported code and chat history for credentials and personal data, and check whether any key found there is still live. The report lists each exposed item with where it appeared and whether it needs rotating.

Fix direction

Set project access to private or workspace-only, rotate any key that was ever pasted into a public project's chat, and move secrets into the builder's secrets store instead of the conversation. Lovable made new projects private by default in November 2025 and offers a secrets feature and a security scan before publishing; use both.

Mechanism documented in: Lovable Docs: Publish (project access vs website access) (verified 2026-09-21); Lovable: Our response to the April 2026 incident (verified 2026-09-21).

Covered by

Pre-launch check ($490, 48 hours) and Full audit ($1,900, 5 business days)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • Secrets committed to the code repositorySecrets and keys

    Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.

    Critical
  • Third-party API key in the JavaScript bundleSecrets and keys

    Anyone who views the page source can take the key and run up charges, send messages or pull data on your account until the key is revoked.

    High
  • Secrets and internals in error messages and logsSecrets and keys

    Keys, session tokens and database connection strings end up in log files and in HTTP responses that anyone can trigger, which hands out credentials and a map of the system's internals.

    High
  • Service-role key shipped in the browser bundleSecrets and keys

    Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.

    Critical

Questions

how do i know if my lovable project is public

Open the project and the publish or share dialog. Lovable separates project access, which controls who can open the editor and remix, from website access, which controls who can visit the published URL. If project access reads Public, other Lovable users can view the code and the chat. Lovable reported that between February and April 2026 a regression let any logged-in user read public projects' chat and source, and afterwards switched all historically public projects to private.

can other people see my chat with an ai app builder

Only if the project is public or shared. In a public project the chat history is part of what is shared, so anything you pasted there, including API keys or customer emails, is visible. Set the project to private, then search your own chat for secrets and rotate any you find.

is a published lovable app the same as a public project

No. Website access decides who can visit the finished app, and on Free and Pro plans a published app is always reachable by link. Project access decides who can open the editor, code and chat. An app can be published for the world while the project itself stays private, and that is the setting most people want.

Back to the catalogue, or run the self-check for your stack.