Why privacy
Leaks aren’t bad luck.They’re a habit.
When you build fast, personal data ends up in places nobody meant it to go. That isn’t carelessness; it’s what fast software looks like. The fix is equally ordinary: look at where the data goes, and close the gaps before your users find them.
How it happens
Five ordinary ways data leaks.
Assistants write working code quickly. They also copy the same shortcuts every time: a client talking straight to the database, a whole user object passed along “just in case”.
console.log(user) is the fastest way to debug, and it quietly sends emails and IDs to whichever log service you use.
Identifying people by email in an analytics or ad tool hands that email to a third party, often without anyone deciding to.
A key committed once stays in history. A service key in a client file is readable by anyone who opens the browser’s dev tools.
Supabase and Firebase are safe when their access rules are on. When the rules are missing, the browser can read every row.
What the evidence says
Common, public and repeated.
Some of these figures come from vendors who sell security tools, and we label them that way. The pattern is consistent anyway.
of 1,645 Lovable-built apps scanned by researchers exposed data, because the apps reached their Supabase database from the browser with no access rules (170 apps).
CVE-2025-48757exposed secrets and 175 personal-data exposures across more than 5,600 apps built with AI tools.
Escape.tech · vendor studysecrets found on public GitHub in 2025, up 34% on the year before.
GitGuardian, State of Secrets Sprawl · vendor studyof AI-generated code samples introduced a vulnerability in Veracode’s tests.
Veracode · vendor studyContext, not a scare
The rules are moving toward knowing your data flows.
None of these is a reason to panic, and a Sentinel scan is not a legal opinion on any of them. They are a reason to know where personal data goes in your code.
New CCPA regulations took effect on 1 January 2026: risk assessments now, cybersecurity audits phased in from 2028 by revenue.
Source →The amended COPPA Rule applies from 22 April 2026 and requires separate parental consent before sharing children’s data with third parties.
Source →Vulnerability-reporting duties began on 11 September 2026; most obligations apply from December 2027.
Source →Black Llama
Privacy, proven in code.
Sentinel reads your code on a sealed machine, finds where personal data and keys could leak, and gives you the fix. Then it gives you a dated badge, so you can show it.
