This one became public yesterday, and I want to walk through it while it's fresh, because the technical part isn't even the part that bothers me most.
What was reported
A researcher named Taimur Khan disclosed 16 vulnerabilities, six of them rated critical, in an exam and grading application built on Lovable and used across UC Berkeley, UC Davis, and a number of K-12 schools. Between the affected institutions, more than 18,000 user records were exposed: student information sitting behind an app that was actively being used to administer and grade real coursework.
The part that actually bothers me
Khan didn't just find this and publish it cold. He filed a support ticket with Lovable first, through the normal channel, the way a responsible disclosure is supposed to work. According to his account, that ticket got closed without any remediation. The vulnerabilities stayed live. The public writeup is what happened after the quiet, proper channel didn't produce a fix.
I've written before about how most of these incidents trace back to a missing setting rather than a sophisticated attack. This one adds a different lesson on top of that: finding the problem isn't the whole battle. Getting it actually fixed, once you've done the responsible thing and reported it quietly, is a separate step, and it doesn't happen automatically just because you did the right thing first.
Why an exam and grading app is a particularly bad place for this
This isn't a todo list or an internal dashboard. It's a system that holds student academic records, potentially personal information tied to minors in the K-12 cases, and it was being used for something with real consequences attached, grades that follow students, coursework tied to their academic standing. The stakes of a data-access flaw scale with what the data actually is and who it belongs to, and this sits about as high on that scale as an indie-built app gets.
What this adds to everything else I've written this year
The technical shape of this is familiar by now, the same family of access-control gaps that's shown up in nearly every incident since the original Lovable disclosure last May. What's new here is the reminder that reporting a problem responsibly isn't the same as it getting fixed. If you're the one who found a gap in someone else's app, be prepared for the possibility that a quiet report doesn't move fast enough, and that public disclosure sometimes ends up being the thing that actually forces action, however imperfect that path is.
What this means if you're building something like this yourself
If your app holds anything resembling academic, health, or otherwise sensitive records tied to real people, especially minors, the checks that have been on this blog since January aren't optional nice-to-haves. Cross-account access tests, admin route checks, database rule audits, all of it, before this kind of data ever goes live, not after a researcher finds it for you and has to fight to get it addressed.