We audit apps built with Lovable, Bolt, v0 and Cursor. The same defects show up over and over — here's the full list, how to spot each one yourself, and what a fix looks like.
Have us check all 12 for you →Critical. Each of these is exploitable by any bored bot or stranger within minutes of discovery.
Any sk-... readable in the browser bundle gets harvested by bots within minutes of deploy. OpenAI bills arrive before you notice.
Spot it: view-source / DevTools → search your deployed site for sk-. Fix: move the call server-side, rotate the key.
service_role key on the frontend.
This key bypasses all Row Level Security. If it's in client code, every visitor effectively has admin access to your database.
Spot it: search your bundle for service_role or a JWT whose payload reads "role":"service_role". Fix: never ship it; use the anon key + RLS.
CREATE TABLE without ENABLE ROW LEVEL SECURITY means anyone with your anon key (it's public!) can read, edit and delete every row — including other users' data. The most common single breach in Lovable/Bolt apps.
Spot it: Supabase dashboard → Table Editor → every table needs "RLS enabled". Fix: enable RLS + a per-user policy.
Attackers can issue refunds and manipulate your account with it.
Spot it: search bundle for sk_live_ / rk_live_. Fix: server-side only + rotate in the Stripe dashboard.
.env committed to the repo.
Push to GitHub — even private, later public, or a contractor's clone — and every secret ships with it.
Spot it: does your repo contain a real .env file? Fix: purge from history, rotate everything, gitignore.
High. No dramatic breach; just slow, expensive damage.
Rules that exist only in the Supabase dashboard are invisible to review and silently lost on re-imports.
Spot it: do you have supabase/migrations/*.sql with policies, or did you click them together in the dashboard? Fix: export to migrations.
Hiding a button is not access control; the API underneath must check roles. Anyone can call your admin API directly.
Spot it: log out, then request your admin API endpoint directly. Did it answer? Fix: server-side role checks.
One scripted loop burns your LLM budget or brute-forces logins while you sleep.
Spot it: search your server code for any rate limiter. If none exists, you have none. Fix: per-IP limits on /auth and AI routes.
Pre-written exploits, zero skill required.
Spot it: run npm audit in your project. Fix: bump the flagged packages.
Medium/low. The stuff visitors feel before they ever trust you with a signup.
No CSP, no HSTS, iframeable pages — turns small bugs into real exploits.
Spot it: paste your URL into securityheaders.com. Fix: add the standard headers at your edge.
Over ~3s time-to-first-byte and visitors leave before your app loads.
Spot it: DevTools → Network → disable cache → reload → look at the first request's TTFB. Fix: edge caching or a lighter hosting setup.
The fastest trust-killer for first-time visitors.
Spot it: click every link on your landing page and primary flow on a phone. Fix: exactly what it sounds like.
No tools beyond your browser. If any step finds something, it's worth a real audit.
sk-, service_role, _live_. Any hit = stop and rotate that key today.api.openai.com (or Anthropic/Google) from the browser? That's a key exposure + an unthrottled bill..env file committed? Is there an .admin route you can reach by typing the URL while logged out?✅ All clean? You're ahead of most vibe-coded apps. Anything red? That's what we fix daily.
Our automated scan covers every item above (plus deeper checks scanners usually miss), delivered as a plain-English report — and we fix the top findings in review-ready PRs. First audits are free while we build our public track record.
5 free audits every week · full report + fix PRs · 48h turnaround
$49 → $0
You're one of our first customers, so this full audit is free. No card, no payment — we turn on paid checkout only once the queue is proven.
To claim your spot, just send us one email. Tell us your app (repo link or live URL) and we'll reply within 48h with your report + fix PRs.
✉️ Email voltaudits@gmail.com nowThe button opens your mail app with a ready template — just fill in your app link and hit send.