Across the 700-plus vibe-coded apps Launch Ready Code has scanned, the average Launch Readiness Score is 42 out of 100 — the most common failures being exposed API keys, Supabase Row Level Security left off, and no rate limits on authentication endpoints. This blog covers the specific CVEs, platform-specific misconfigurations, and security patterns behind those failures, with actionable fixes ranked by severity and the platforms most likely to ship each flaw.
Methodology: OWASP Top 10 · MITRE CWE Top 25 · CVSS v3
A look across the apps we've scanned (Mar–Jun 2026): most vibe-coded apps shipped at least one P0, and few were launch-ready. Platform-by-platform breakdown inside.
In May 2025, 170+ Lovable apps had Supabase row-level security disabled. No login. No exploit. One anonymous REST call returned the entire user database — emails, payment records, private content. Here is the technical breakdown, the attack vector, and the fix.
Quittr hit $1M in 10 days. Then 39,000 sobriety journals became publicly readable. One Firebase rule. Three lines to fix. The full technical breakdown.
Lovable, Bolt.new, Cursor, Replit, Claude Code, Windsurf, v0.dev, and Copilot compared on secrets, database rules, rate limits, and headers.
Every VITE_ variable in your Bolt.new app ships to the browser by design. Which keys are safe, how to move secrets to edge functions, how to check.
Bolt.new builds browser-first, so keys leak into the bundle and RLS stays off. Audit your live app free in 30 seconds before you launch.
Claude Code writes clean code, but your shipped app can still leak secrets and skip rate limiting. Audit your live app free in 30 seconds before launch.
Copilot suggests code it learned from public repos, unsafe habits included. The patterns that carry in, the deploy gaps it cannot see, and a free 30-second scan.
Cursor writes the code, but you own the deploy. What a Cursor security audit checks, the .cursorrules tell, and how to scan your live app free.
Cursor vs Copilot security is a tie: both write working code and skip the deploy work. What each tool leaves open, and the checklist that closes it.
Lovable wires up Supabase for you. It does not turn on RLS, keep keys out of the bundle, or add rate limits. Audit your live app free in 30 seconds before you launch.
Replit handles TLS and the servers. Rate limits, headers, database rules, and secrets are yours. The split, the checklist, and a free 30-second scan.
Replit fixed its agent after the 2025 database deletion. Your shipped app is still your job. Scan your live URL free in 30 seconds before launch.
v0.dev writes your UI. It does not guard your keys. NEXT_PUBLIC_ leaks, server vs client components, and headers on Vercel — plus a free 30-second scan.
Windsurf writes the code, but you own the deploy. What a Windsurf security audit checks, the .windsurfrules tell, and how to scan your live app free.
Bolt.new ships apps fast. Supabase RLS is off by default, secrets end up in client code, and auth routes are unprotected. Here is what to audit before you launch.
Cursor tab completions propagate insecure patterns from your codebase. Secrets end up committed. No PR review step before deploy. Here is the security checklist.
Replit makes deployment invisible and that invisibility hides real security gaps. Secrets tab vs hardcoded env, public repls exposing source, no rate limiting.
Supabase RLS, exposed API keys, missing rate limiting, absent CSRF protection. What a Lovable audit checks, what it typically finds (avg ~44/100), and a pre-launch checklist for every app.
Bolt.new builds full-stack apps fast. Authentication middleware, rate limiting, CSRF protection, and HTTP security headers require manual implementation. What a Bolt audit checks and what it finds.
Lovable is safe to build with — not always safe to launch blind. The honest 2026 answer on Lovable security, the CVE-2025-48757 RLS flaw, common gaps, and how to check your app in 60 seconds.
Four-step framework for auditing AI-generated code before launch: secret scanning, dependency review, SAST, and runtime header checks. OWASP A01/A07, CWE-200, CWE-798, CWE-89, CWE-94, CVE-2025-48757.
v0 generates Next.js UI. NEXT_PUBLIC_ variables, missing server-side auth, absent rate limits, and no CSP are the four gaps most v0 apps ship with. A step-by-step pre-launch audit guide.
Copilot suggestions inherit insecure patterns from public training data. SQL injection, hardcoded secrets, missing rate limits — the class-by-class audit guide for Copilot-assisted apps.
CVE-2025-66032 (CVSS 8.1, fixed in Claude Code v1.0.93) allowed arbitrary code execution via malicious context injection. What else to audit in Claude Code–built apps before launch.
Eight steps to secure a Lovable-built app: enable RLS on every table, move secrets to environment variables, enforce auth on routes, add rate limiting, set security headers, sync to GitHub, add error tracking, and scan your live URL.
Bolt.new is not a framework. It is an AI coding agent that generates apps using standard frameworks. What it outputs and what the security implications are.
The 20-item production readiness checklist for Lovable apps. Security, reliability, performance, and monitoring checks specific to Lovable and Supabase.
The complete security guide for Windsurf (Codeium) apps. What Windsurf generates, where the security gaps are, and the step-by-step process to close them before launch.
Claude Code is Anthropic's terminal-based AI coding agent. What it does, how it differs from Cursor and Copilot, and the security considerations for Claude Code projects.
Lovable defaults to Supabase with RLS. Bolt.new ships faster but skips the hardening. The founder checklist for both, before real users arrive.
Both ship a working SaaS fast. Neither one locks down your database or your secrets for you. The checklist that closes the gap on either platform.
All three sell compliance automation. None of them check your Supabase RLS, your GDPR data map, or your EU AI Act disclosure. Here's what to actually budget for.
N+1 queries and missing indexes are the two most common database performance issues in AI-built apps. The checklist to find and fix both before launch.
Firebase ships in test mode: allow read, write: if true. Most vibe-coded apps launch that way. How to write owner-scoped rules before someone finds you.
Lovable wires Supabase for you. It does not lock it down. Where RLS fits, why the anon key is not the leak, and what CVE-2025-48757 proved.
Naive RLS policies re-run auth.uid() on every row. Wrap it in a select, index your policy columns, and your Supabase queries get fast again. Here is how.
The Supabase anon key is meant to be public. The service_role key never is. Here is which belongs where, and why RLS is what actually protects your data.
Supabase Auth ships with soft defaults: no forced email checks, long JWT life, open redirects. The 7-point checklist vibe-coded apps skip before launch.
AI editors scaffold Supabase edge functions that run but skip real auth. What JWT checks, service role handling, and CORS need before you launch.
Supabase storage security in plain English: public vs private buckets, storage policies that mirror RLS, signed URLs, and the mistakes that leak files.
The four Supabase security layers that fail most often: RLS policies, service_role key exposure, Edge Function auth, and Storage bucket permissions. Includes three diagnostic SQL queries you can run right now.
How to check if your Supabase Row Level Security is correctly configured — including the three SQL queries that diagnose disabled RLS, missing policies, and the dangerous USING (true) pattern.
RLS policies are the single line between private and public data in vibe-coded SaaS. The two silent failure modes — and how to fix them before users arrive.
31 of 47 vibe-coded apps we scanned had Supabase RLS disabled. Here is what that means, how it fails silently, and the exact policies to fix it.
What API rate limiting stops, where to add it first, copy-paste setups for Express, Next.js and FastAPI, and how to test yours with a burst.
Rotate first, then find the leak, then check for abuse, then move the call server-side. Exact rotation steps for Stripe, Supabase, and OpenAI keys.
Six security headers, each one's job in one sentence, and copy-paste configs for Vercel, Netlify, Render, and Cloudflare. Check yours free in seconds.
Supabase and most AI builders keep your login JWT in localStorage by default. Any script on your page can read it. Here is where to store it safely.
When your app throws a CORS error, the AI tells you to set Access-Control-Allow-Origin to a wildcard. On a logged-in endpoint, that one line lets any website read your users’ data. Here is what our scanner flags at 0.99 confidence — and the safe four-step fix.
Some keys are built to be seen. Some are a breach in plain sight. The mental model that separates pk_live from sk_live, the anon key from service_role.
Most vibe-coded apps carry hardcoded API keys, tokens, and credentials baked into their AI-generated bundles. Here is how to find and fix them before launch.
Lovable apps ship API keys to the browser by default. The 5 practices that secure Lovable API keys without slowing your launch — starting with a free scan.
Your AI builder wired the schema, not the recovery plan. What platforms back up by default, and the restore test everyone skips.
Most founders learn about crashes from support email. That is too late. What to track — errors, uptime, slow queries — and how to set it up in month one.
You can't report a breach you can't detect. What Article 33 requires in 72 hours, what Article 34 adds, and the logging an AI-built app needs before the clock starts.
A customer files a GDPR access request. Your AI-built app has no data map. The Article 15 deadline, what to send, and where the data actually hides.
Lovable, Bolt, and Cursor can process user data while they build. Here's when GDPR Article 28 requires a signed DPA, and what to do if a vendor won't sign one.
No major AI coding tool signs a Business Associate Agreement, and Lovable’s own terms ban uploading PHI. What that means before real patient data touches your app.
The four risk tiers in plain English and a ten-minute decision path. Most SaaS products land in limited risk — one duty, enforceable from August 2, 2026.
Your database tech is visible from DNS alone. Ten post-launch hardening steps with copy-paste SQL: RLS on every table, locked buckets, rate limits, tested backups.
Enterprise buyers now ask if AI wrote your code. What the form really tests, the honest answer that keeps the deal, and a one-week plan to send it back.
Big buyers, auditors, and the EU AI Act all ask for the same document. The seven sections your AI policy needs, and a plan to ship it this week.
EU AI Act fines run three tiers, not one number. Which tier your SaaS faces, why Article 50 matters, and what to fix before August 2, 2026.
GDPR data mapping when an AI wrote your code: find where personal data lives, list your vendors, set retention, and build your Article 30 record.
ISO 27001 for startups, in plain words: what the standard covers, why AI-built code fails the audit, what prep costs. We prep. We do not certify.
SOC 2 is a CPA-issued report, not a badge you buy. What auditors ask about AI-generated code, what prep costs, and how to get ready. We prep, not certify.
What SOC 2's CC7.1 control actually requires, why AI-built apps fail it by default, and the practical remediation workflow auditors expect to see.
Nessus scans internal networks. A Lovable, Bolt, or Cursor app has none. What a URL-based vulnerability scanner should check instead, and where founders usually go wrong.
The vibe coding compliance checklist for AI-built apps: GDPR basics, EU AI Act Article 50, SOC 2 readiness, privacy policy, and data retention.
The transparency rules many founders call “Article 52” are now Article 50 in the final law. Here is the 8-point checklist for vibe-coded SaaS — chatbot disclosure, AI labels, deepfakes, the AI register — before the August 2, 2026 deadline.
Check Lovable, Bolt.new, or Cursor apps for data handling, consent, and EU AI Act overlap — no code access needed. The gaps AI builders leave behind.
Enforcement begins August 2, 2026. Know your risk tier and the three fixes to make before the deadline — written for founders, not lawyers.
Article 50 requires AI chatbots and assistants to disclose they are AI. A full compliance guide with copy templates and compliant examples.
Sprinto Year-2 renewals run 30–40% above Year-1 pricing. Before you renew, audit what you actually need — and whether the increase is worth it.
Detectify starts near $249 a month and was built for security teams. Five options for indie founders, priced and compared — and the flaw class every generic scanner misses.
OWASP ZAP, Postman, 42Crunch, and Burp Suite compared for API security testing — and the BOLA gap none of them catch alone.
Fortify is big-company SAST built for big AppSec teams. Why it is the wrong fit for a Lovable, Bolt, or Cursor build, and what actually catches the risk.
Exposed secrets and a leaky Supabase table are now common findings before a seed or Series A round. What investors check, and how founders fix both before the data room opens.
Automated pentesting and a real penetration test are not the same thing. What each one actually checks, what it costs, and which one a founder needs before launch.
A fractional CTO runs $2k–$5k a month. A full-time senior hire runs $180k+ a year. What each actually covers, and when to pick which one.
OWASP ZAP and other open source DAST tools are free and catch real bugs. What they cannot see: an access-control gap that still returns a normal 200. Where free tools end and a done-for-you audit begins.
Supabase the platform is safe. Row Level Security ships off by default on every table. Here is the honest split between what Supabase secures for you and what you must configure yourself.
Semgrep, Snyk, gitleaks, and Trivy catch real bugs in your code before it ships. None of them can see a disabled Row Level Security rule or a missing rate limit — those live in your runtime settings, not your source.
Why is AI generated code insecure? The models are graded on code that runs, not code that resists attack. The failure modes, dimension by dimension.
The best vibe coding security tools by category: secret scanners, dependency checkers, headers checkers, and URL-based readiness scans. Free first.
P0 to P3 severity, CVSS vs real risk, and a week-by-week fix plan. How founders read a security audit report — and the red flags of a bad one.
The pre launch checklist SaaS founders need: 15 checks across security, reliability, performance, and monitoring, each with a self-test you can run now.
Score your app out of 100 across security, reliability, performance and monitoring. A self-scoring launch readiness checklist for SaaS founders.
Security audit costs in 2026: $0 free scans, $499 audit reports, low-thousands consultant reviews, five-figure pen tests. Full price table inside.
69 plain-English AI security terms for founders. RLS, anon keys, prompt injection, Article 50 - what each means and why it can sink a launch.
Snyk scans dependencies and code. AI code auditing scans what your app exposes after deployment. The complete breakdown of what each covers, when to use which, and how to combine them.
Every developer shipping software in 2026 needs to understand security. AI coding tools democratize app creation — they also democratize the attack surface. Why cybersecurity is now a core skill.
Checkmarx One is an enterprise application security platform combining SAST, SCA, DAST, and IaC scanning. What it does, what it costs, and the alternatives.
Intruder scans infrastructure. Launch Ready Code audits AI-built apps across 4 dimensions. Exactly what each one covers and when to use which.
Launch Ready Code is an AI-built app readiness scanner, not a general security auditing tool. Exactly what it checks, what it does not, and when to use it versus alternatives.