We audit apps built with Lovable, Bolt, v0, Cursor, Claude Code, Codex, ZCode and other AI coding agents. The same defects show up over and over — here's the full list, how to spot each one yourself, and what a fix looks like.
Ask about an early-access review →Critical. Each of these is exploitable by any bored bot or stranger within minutes of discovery.
Any sk-... readable in the browser bundle gets harvested by bots within minutes of deploy. OpenAI bills arrive before you notice.
Spot it: view-source / DevTools → search your deployed site for sk-. Fix: move the call server-side, rotate the key.
service_role key on the frontend.
This key bypasses all Row Level Security. If it's in client code, every visitor effectively has admin access to your database.
Spot it: search your bundle for service_role or a JWT whose payload reads "role":"service_role". Fix: never ship it; use the anon key + RLS.
CREATE TABLE without ENABLE ROW LEVEL SECURITY means anyone with your anon key (it's public!) can read, edit and delete every row — including other users' data. The most common single breach in Lovable/Bolt apps.
Spot it: Supabase dashboard → Table Editor → every table needs "RLS enabled". Fix: enable RLS + a per-user policy.
Attackers can issue refunds and manipulate your account with it.
Spot it: search bundle for sk_live_ / rk_live_. Fix: server-side only + rotate in the Stripe dashboard.
.env committed to the repo.
Push to GitHub — even private, later public, or a contractor's clone — and every secret ships with it.
Spot it: does your repo contain a real .env file? Fix: purge from history, rotate everything, gitignore.
High. No dramatic breach; just slow, expensive damage.
Rules that exist only in the Supabase dashboard are invisible to review and silently lost on re-imports.
Spot it: do you have supabase/migrations/*.sql with policies, or did you click them together in the dashboard? Fix: export to migrations.
Hiding a button is not access control; the API underneath must check roles. Anyone can call your admin API directly.
Spot it: log out, then request your admin API endpoint directly. Did it answer? Fix: server-side role checks.
One scripted loop burns your LLM budget or brute-forces logins while you sleep.
Spot it: search your server code for any rate limiter. If none exists, you have none. Fix: per-IP limits on /auth and AI routes.
Pre-written exploits, zero skill required.
Spot it: run npm audit in your project. Fix: bump the flagged packages.
Medium/low. The stuff visitors feel before they ever trust you with a signup.
No CSP, no HSTS, iframeable pages — turns small bugs into real exploits.
Spot it: paste your URL into securityheaders.com. Fix: add the standard headers at your edge.
Over ~3s time-to-first-byte and visitors leave before your app loads.
Spot it: DevTools → Network → disable cache → reload → look at the first request's TTFB. Fix: edge caching or a lighter hosting setup.
The fastest trust-killer for first-time visitors.
Spot it: click every link on your landing page and primary flow on a phone. Fix: exactly what it sounds like.
No tools beyond your browser. If any step finds something, it's worth a real audit.
sk-, service_role, _live_. Any hit = stop and rotate that key today.api.openai.com (or Anthropic/Google) from the browser? That's a key exposure + an unthrottled bill..env file committed? Is there an .admin route you can reach by typing the URL while logged out?All clean? You're ahead of most vibe-coded apps. Anything red? That's what we fix daily.
Our scanner automates the repository, deployed-bundle, and bounded public-site checks it can observe, with coverage status shown in the report. Dashboard state, authenticated authorization, business flows, and data ownership require explicit manual verification. During validation, selected early-access scans may be free; this is not a production SLA or a promise of fixes.
Apply for early-access review →The form composes a structured application email, or include your email, app name, public HTTPS URL or public repository, builder, requested tier, and authorization confirmation. Never send passwords, tokens, API keys, private keys, or .env files.