Thousands of applications built on no-code AI platforms like Lovable, Base44, Replit, and Netlify are leaking sensitive corporate and personal data publicly online.
A security analysis has uncovered widespread data exposure across applications created using AI-powered, no-code development platforms. The affected services enable rapid web app creation with minimal technical expertise, but thousands of resulting applications are broadcasting confidential information to the open internet.
Platforms implicated in the exposure include Lovable, Base44, Replit, and Netlify—all major players in the low-code and no-code development space. These tools democratize app development by allowing users to build functional web applications in seconds using AI assistance.
However, the speed and simplicity come with a critical security cost. Developers using these platforms have inadvertently exposed API keys, authentication tokens, database credentials, and personal user information. In some cases, the exposed data includes corporate secrets and financial records.
The exposure stems from multiple factors: default insecure configurations, developers unfamiliar with security best practices shipping applications without proper credential management, and platforms not enforcing security guardrails by default. Many of the vulnerable apps remain publicly accessible, presenting ongoing risk to affected organizations and individuals.
The issue highlights a growing concern in the rapid-development space. As barriers to entry lower, security knowledge gaps widen. Users without traditional software development backgrounds may lack understanding of fundamental security principles—particularly around credential handling and environment variable management.
No official response or timeline for remediation has been announced from the affected platforms. Security researchers have typically reported findings to the companies involved, but disclosure patterns remain unclear.
The discovery underscores the need for platform-level security defaults and developer education as AI-assisted development becomes more accessible. Organizations using these platforms should audit their deployed applications for exposed credentials and implement proper secret management practices immediately.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.