Is Your Lovable, Bolt or Cursor App Secure? 10 Checks Before You Launch an AI-Built App

Short answer: an app built with Lovable, Bolt, v0, Replit, Cursor or Claude Code is not secure by default. Before real users arrive, check that every database table has access rules, that no secret key is in the browser, that every write is checked on the server, and that you have backups you have restored at least once. The ten checks below take a developer a day or two on most apps.

This is not hypothetical

• Open databases. In 2025 a researcher scanned 1,645 apps from Lovable's public showcase and found 170 whose Supabase databases could be read or written without logging in, because row-level security was missing or too loose. It was recorded as CVE-2025-48757.
• Insecure code. Veracode's 2025 GenAI Code Security Report tested more than 100 language models on 80 coding tasks: the generated code introduced security flaws in 45% of cases.
• Destroyed data. In July 2025, an AI agent on Replit deleted a live production database during a code freeze in SaaStr founder Jason Lemkin's public trial. Replit's CEO called it unacceptable and added separation between development and production databases.

The 10 checks

1. Row-level security on every table. In Supabase, enable RLS and write policies, then test them by signing in as a second user and trying to read the first user's rows. In Firebase, check the security rules.
2. No secret keys in the browser. Anything in a VITE_ or NEXT_PUBLIC_ variable is visible to every visitor. Only public keys belong there; service-role keys, payment secrets and AI API keys stay on the server.
3. Every write checked on the server. Hiding a button is not security. Anyone can call your API directly.
4. No IDs you can change in the URL. Changing /orders/123 to /orders/124 must not show someone else's order.
5. A proven auth provider. Never store passwords yourself; use Supabase Auth, Firebase Auth, Clerk or similar, with email verification.
6. Rate limits on sign-up, login, OTP, contact forms and any endpoint that calls a paid AI API.
7. Verified payment webhooks. Check the provider's signature, or anyone can mark an order as paid.
8. Separate development and production. Different databases and keys; the AI agent never gets production credentials.
9. Backups you have restored. Daily backups, and one test restore, before launch.
10. Errors and uptime alerts. Error tracking and an uptime check, so you hear about problems before your users tell you.

Fix or rebuild?

Most AI-built apps are worth fixing: the screens and flows are fine, and the problems sit in data access, secrets and deployment. A rebuild makes sense when the data model is wrong for the business or the same logic is copied across dozens of files. A code and security review tells you which.

Need a second pair of eyes?

We review AI-built apps, fix what is unsafe and take them live, without forcing a rewrite: vibe coding help and application security. Founders anywhere can reach us on WhatsApp +91 93091 93613.

Sources: NVD: CVE-2025-48757; Veracode: 2025 GenAI Code Security Report; Fortune: Replit AI agent wiped a database (July 2025); Supabase: Row Level Security; OWASP Top 10.