7500 site operators failing to "action provided findings" seems like a systematic failure on your part and you should accept more responsibility for it. I'm guessing users find the security warnings unclear, confusing, or meaningless. Don't allow users to publish apps if you know they leak private data. Work on educating users and make the apps be built securely the first time.
And that's why I believe auto-fix will solve a lot of problems in this space. We are now training our auto-fix to be very considerate and avoid breaking changes, trace back to user prompts and intent. The goals is to make it widely adopted and one day (soon!) turn on by default.
This is the new future, I'm just not sure I want to be part of it.
Have you made an inventory of all of the places where the data ended up?
Have all parties that ended up with copies confirmed the copies are destroyed and had not been passed on?
Have you reported an inadvertent disclosure to the DPA?
On a larger note, and not at all to downplay the seriousness of this breach, but this feels like the kind of growing pain we're going to continue going through as we move to an AI-driven world. Who's responsible for the work of the AI? In this case, I think it's pretty cut and dry, since Lovable sells a service that _happens_ to be powered by AI (it could just as easily have been done by an outsourced team instead). But as AI gains more agency, it's going to become less and less clear…
The controller/processor relationship is very clearly described as part of the GDPR and there is little doubt in my mind that both of these parties jointly and separately carry responsibility here.
Any data fetched during the analysis was deleted long ago, though you’ll have to take my word for that. Only metadata was retained.
That said, I fully agree that no one can say for certain whether anyone else collected this data or what happened to it afterward.
1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?
2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.
3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?
4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.
5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?
Is this supposed to be a roadmap to security antipatterns?
It's so interesting how you've created a nice ecosystem where you're not responsible for the security problems but at the same time your users are meant to trust you to take care of that. We really need to change the laws around this.