CVE-2025-48757 — Lovable project-enumeration exposure

Lovable's project API exposed project metadata (name, slug, collaborator emails, GitHub repo ID, Firebase token scope) without verifying ownership. Affected 170+ apps at disclosure time and — per Cyber Kendra's April 2026 report — re-broke after the initial patch.