This hack is good, but Lovable gets confused by the instructions you send them.
Something’s wrong with the extension; it won’t let me enter the password.
WARNING: Security Analysis of this Extension (v5.1)
I did a full reverse engineering of the source code. Here’s what this extension actually does:
1. Replaces window.fetch(), XMLHttpRequest, and WebSocket globally (page-ws.js lines 314-611). Every single HTTP request made by lovable.dev passes through the extension’s code.
2. Captures your Bearer token from every request with an Authorization header and sends it to io.eklas.dev/api/v1/lovable/session along with your email, project ID, workspace ID, and Castle anti-fraud token.
3. Steals your session cookies — the extension reads ALL lovable.dev cookies including lovable-session-id.refresh (background.js lines 237-296) and sends them to the external server.
4. Collects a hardware fingerprint of your device — screen, GPU, CPU cores, canvas fingerprint, audio fingerprint, installed fonts — hashed with SHA-256 (fingerprint.js).
5. The server (io.eklas.dev) has full access to your lovable.dev account — it receives your JWT tokens, refresh cookies, and can act on your behalf.
6. It doesn’t even work anymore — their own announcement from July 21 says “the extension is currently consuming credits instead of working as intended.”
What you should do RIGHT NOW:
- Uninstall the extension
- Go to https://myaccount.google.com/connections → Remove access for Lovable (if you use Google sign-in)
- Or change your lovable.dev password
Bottom line: This extension gives a third party full access to your account — and it doesn’t even work.
!