An external audit is a slow way to learn your production database has a public form

These three failures come from three different mechanisms, and only one of them traces back to a person.

The Lovable form had no authentication because the platform did not require one before publishing ^[15]. That is a default. The Replit survey reached a shared datastore with no encryption, which the writeup attributes to user oversight ^[15]. That one training plausibly catches. The Vercel page shipped an API key inside client-side JavaScript ^[12], so the key went to every browser that loaded the page, and no takedown can undo that.

The more telling detail in the Lovable case is that operations had no record of the app at all until an external audit reported it publicly exposed ^[9]. It was built outside the SDLC, so provisioning, version control and the ticket queue have nothing to hand you ^[10]. Asset management and security monitoring know what was registered through them, and these three were registered nowhere ^[13].

The figure the article leans on is a 2023 study counting 380,000 publicly accessible applications across platforms including Replit, Lovable and Vercel, with 22 percent holding exposed credentials, API keys or proprietary data ^[14]. Multiply it out and you get roughly 83,600 applications ^[7]. The article does not name the study, its authors, or its scanning method ^[16]. For that number to say anything about your estate, several things would have to be true: that "publicly accessible" meant reachable without credentials rather than merely resolvable, that the population was not dominated by tutorials and abandoned demos, that a hit was a live secret rather than a placeholder, and that redeploys of the same project were deduplicated. None of that is checkable from the text. It supports the claim that the class exists, but it does not amount to a base rate.

The prescribed remedy is external attack surface management, security-by-design inside the low-code workflow, and mandatory security training for non-technical users ^[4]. Read what the discovery half keys on: web crawling, DNS enumeration and certificate transparency logs, scoped to an organisation's domains, IP ranges or branding ^[1]. The article's own worked example is an employee deploying on Vercel with a company email, where domain registration or certificate issuance produces the hit ^[2]. Invert the example and the coverage boundary appears. An app served from a vendor's shared subdomain, created with a personal address, issues no certificate in your name and enumerates under nobody's zone but the platform's. Discovery reaches assets that carry one of your identifiers, and the article does not describe the channel that reaches the rest.

I still think the ordering is right in my context, which is an estate where anyone with a corporate card can publish. Scanning produces a roster of builders. Training works the roster. Training first assumes you already know who is deploying, and the intake form is the counterexample: nobody knew it existed until someone outside the company looked ^[9].