Lovable, a vibe-coding platform, is downplaying a vulnerability report that exposed sensitive user information, including credentials and source code, to anyone with a free account. Initially, the company attributed the issue to "intentional behavior" and unclear documentation, but later shifted the blame to HackerOne, a bug-bounty service1. The researcher's findings highlighted a significant flaw in Lovable's security, allowing unauthorized access to sensitive data. The company's response has been inconsistent, sparking concerns about its ability to handle vulnerability reports. Lovable's actions demonstrate a lack of transparency and accountability, which can erode user trust. This incident matters to practitioners because it showcases the importance of a well-coordinated vulnerability disclosure process, highlighting the need for clear communication and prompt action to protect sensitive user data.