Bug bounty program · HackerOne
Lovable VDP
Most upvoted reports7
- #3371448ValidImproper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)Lovable VDP · Access Control · 2025 · Low–79votes
- #3591764ValidBusiness Logic Bypass Allows Setting “Read Access” Role Without Pro Plan SubscriptionLovable VDP · Input Validation and Logic · 2026 · Medium–78votes
- #3599248ValidBypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameterLovable VDP · Open Redirect · 2026 · Medium–74votes
- #3370430ValidUsers can change project visibility which requires high subscription by just changing request bodyLovable VDP · Access Control · 2026 · Medium–71votes
- #3371414ValidImproper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)Lovable VDP · Access Control · 2025 · Low–66votes
- #3369843ValidLow-privileged user can enable or disable Lovable AI for new projects in workspaceLovable VDP · Access Control · 2025 · Low · a user account (title)–56votes
- #3581815ValidOpen Redirect on lovable.dev via redirect parameter leads to phishing attacksLovable VDP · No weakness recorded · 2026–44votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.