CVE breakdowns, platform-specific audit guides, and monthly scan data from Launch Ready Code. Methodology: OWASP Top 10 · CWE Top 25 · CVSS v3.
Aggregate data from 127 URL scans (Mar–Jun 2026): 71% of vibe-coded apps shipped at least one P0, the average app carried 2.3 critical findings, and just 12% were launch-ready. Platform-by-platform breakdown inside.
In May 2025, 170+ Lovable apps had Supabase row-level security disabled. No login. No exploit. One anonymous REST call returned the entire user database — emails, payment records, private content. Here is the technical breakdown, the attack vector, and the fix.
Quittr hit $1M in 10 days. Then 39,000 sobriety journals became publicly readable. One Firebase rule. Three lines to fix. The full technical breakdown.
Lovable, Bolt.new, Cursor, Replit, Claude Code, Windsurf, v0.dev, and Copilot compared on secrets, database rules, rate limits, and headers.
Every VITE_ variable in your Bolt.new app ships to the browser by design. Which keys are safe, how to move secrets to edge functions, how to check.
Bolt.new builds browser-first, so keys leak into the bundle and RLS stays off. Audit your live app free in 30 seconds before you launch.
Claude Code writes clean code, but your shipped app can still leak secrets and skip rate limiting. Audit your live app free in 30 seconds before launch.
Cursor writes the code, but you own the deploy. What a Cursor security audit checks, the .cursorrules tell, and how to scan your live app free.
Cursor vs Copilot security is a tie: both write working code and skip the deploy work. What each tool leaves open, and the checklist that closes it.
Replit handles TLS and the servers. Rate limits, headers, database rules, and secrets are yours. The split, the checklist, and a free 30-second scan.
Replit fixed its agent after the 2025 database deletion. Your shipped app is still your job. Scan your live URL free in 30 seconds before launch.
v0.dev writes your UI. It does not guard your keys. NEXT_PUBLIC_ leaks, server vs client components, and headers on Vercel — plus a free 30-second scan.
Windsurf writes the code, but you own the deploy. What a Windsurf security audit checks, the .windsurfrules tell, and how to scan your live app free.
Bolt.new ships apps fast. Supabase RLS is off by default, secrets end up in client code, and auth routes are unprotected. Here is what to audit before you launch.
Cursor tab completions propagate insecure patterns from your codebase. Secrets end up committed. No PR review step before deploy. Here is the security checklist.
Replit makes deployment invisible and that invisibility hides real security gaps. Secrets tab vs hardcoded env, public repls exposing source, no rate limiting.
Supabase RLS, exposed API keys, missing rate limiting, absent CSRF protection. What a Lovable audit checks, what it typically finds (avg 42/100), and a pre-launch checklist for every app.
Bolt.new builds full-stack apps fast. Authentication middleware, rate limiting, CSRF protection, and HTTP security headers require manual implementation. What a Bolt audit checks and what it finds.
Lovable is safe to build with — not always safe to launch blind. The honest 2026 answer on Lovable security, the CVE-2025-48757 RLS flaw, common gaps, and how to check your app in 60 seconds.
Firebase ships in test mode: allow read, write: if true. Most vibe-coded apps launch that way. How to write owner-scoped rules before someone finds you.
Lovable wires Supabase for you. It does not lock it down. Where RLS fits, why the anon key is not the leak, and what CVE-2025-48757 proved.
Naive RLS policies re-run auth.uid() on every row. Wrap it in a select, index your policy columns, and your Supabase queries get fast again. Here is how.
The Supabase anon key is meant to be public. The service_role key never is. Here is which belongs where, and why RLS is what actually protects your data.
Supabase Auth ships with soft defaults: no forced email checks, long JWT life, open redirects. The 7-point checklist vibe-coded apps skip before launch.
AI editors scaffold Supabase edge functions that run but skip real auth. What JWT checks, service role handling, and CORS need before you launch.
Supabase storage security in plain English: public vs private buckets, storage policies that mirror RLS, signed URLs, and the mistakes that leak files.
The four Supabase security layers that fail most often: RLS policies, service_role key exposure, Edge Function auth, and Storage bucket permissions. Includes three diagnostic SQL queries you can run right now.
How to check if your Supabase Row Level Security is correctly configured — including the three SQL queries that diagnose disabled RLS, missing policies, and the dangerous USING (true) pattern.
RLS policies are the single line between private and public data in vibe-coded SaaS. The two silent failure modes — and how to fix them before users arrive.
31 of 47 vibe-coded apps we scanned had Supabase RLS disabled. Here is what that means, how it fails silently, and the exact policies to fix it.
What API rate limiting stops, where to add it first, copy-paste setups for Express, Next.js and FastAPI, and how to test yours with a burst.
Rotate first, then find the leak, then check for abuse, then move the call server-side. Exact rotation steps for Stripe, Supabase, and OpenAI keys.
Six security headers, each one's job in one sentence, and copy-paste configs for Vercel, Netlify, Render, and Cloudflare. Check yours free in seconds.
Supabase and most AI builders keep your login JWT in localStorage by default. Any script on your page can read it. Here is where to store it safely.
When your app throws a CORS error, the AI tells you to set Access-Control-Allow-Origin to a wildcard. On a logged-in endpoint, that one line lets any website read your users’ data. Here is what our scanner flags at 0.99 confidence — and the safe four-step fix.
Most vibe-coded apps carry hardcoded API keys, tokens, and credentials baked into their AI-generated bundles. Here is how to find and fix them before launch.
Lovable apps ship API keys to the browser by default. The 5 practices that secure Lovable API keys without slowing your launch — starting with a free scan.
Your AI builder wired the schema, not the recovery plan. What platforms back up by default, and the restore test everyone skips.
Most founders learn about crashes from support email. That is too late. What to track — errors, uptime, slow queries — and how to set it up in month one.
The four risk tiers in plain English and a ten-minute decision path. Most SaaS products land in limited risk — one duty, enforceable from August 2, 2026.
Your database tech is visible from DNS alone. Ten post-launch hardening steps with copy-paste SQL: RLS on every table, locked buckets, rate limits, tested backups.
Enterprise buyers now ask if AI wrote your code. What the form really tests, the honest answer that keeps the deal, and a one-week plan to send it back.
Big buyers, auditors, and the EU AI Act all ask for the same document. The seven sections your AI policy needs, and a plan to ship it this week.
EU AI Act fines run three tiers, not one number. Which tier your SaaS faces, why Article 50 matters, and what to fix before August 2, 2026.
GDPR data mapping when an AI wrote your code: find where personal data lives, list your vendors, set retention, and build your Article 30 record.
ISO 27001 for startups, in plain words: what the standard covers, why AI-built code fails the audit, what prep costs. We prep. We do not certify.
SOC 2 is a CPA-issued report, not a badge you buy. What auditors ask about AI-generated code, what prep costs, and how to get ready. We prep, not certify.
What SOC 2's CC7.1 control actually requires, why AI-built apps fail it by default, and the practical remediation workflow auditors expect to see.
Nessus scans internal networks. A Lovable, Bolt, or Cursor app has none. What a URL-based vulnerability scanner should check instead, and where founders usually go wrong.
The vibe coding compliance checklist for AI-built apps: GDPR basics, EU AI Act Article 50, SOC 2 readiness, privacy policy, and data retention.
The transparency rules many founders call “Article 52” are now Article 50 in the final law. Here is the 8-point checklist for vibe-coded SaaS — chatbot disclosure, AI labels, deepfakes, the AI register — before the August 2, 2026 deadline.
Check Lovable, Bolt.new, or Cursor apps for data handling, consent, and EU AI Act overlap — no code access needed. The gaps AI builders leave behind.
Enforcement begins August 2, 2026. Know your risk tier and the three fixes to make before the deadline — written for founders, not lawyers.
Article 50 requires AI chatbots and assistants to disclose they are AI. A full compliance guide with copy templates and compliant examples.
Sprinto Year-2 renewals run 30–40% above Year-1 pricing. Before you renew, audit what you actually need — and whether the increase is worth it.
Detectify starts near $249 a month and was built for security teams. Five options for indie founders, priced and compared — and the flaw class every generic scanner misses.
OWASP ZAP, Postman, 42Crunch, and Burp Suite compared for API security testing — and the BOLA gap none of them catch alone.
Fortify is big-company SAST built for big AppSec teams. Why it is the wrong fit for a Lovable, Bolt, or Cursor build, and what actually catches the risk.
Exposed secrets and a leaky Supabase table are now common findings before a seed or Series A round. What investors check, and how founders fix both before the data room opens.
Automated pentesting and a real penetration test are not the same thing. What each one actually checks, what it costs, and which one a founder needs before launch.
A fractional CTO runs $2k–$5k a month. A full-time senior hire runs $180k+ a year. What each actually covers, and when to pick which one.
OWASP ZAP and other open source DAST tools are free and catch real bugs. What they cannot see: an access-control gap that still returns a normal 200. Where free tools end and a done-for-you audit begins.
Supabase the platform is safe. Row Level Security ships off by default on every table. Here is the honest split between what Supabase secures for you and what you must configure yourself.
Semgrep, Snyk, gitleaks, and Trivy catch real bugs in your code before it ships. None of them can see a disabled Row Level Security rule or a missing rate limit — those live in your runtime settings, not your source.
Why is AI generated code insecure? The models are graded on code that runs, not code that resists attack. The failure modes, dimension by dimension.
The best vibe coding security tools by category: secret scanners, dependency checkers, headers checkers, and URL-based readiness scans. Free first.
P0 to P3 severity, CVSS vs real risk, and a week-by-week fix plan. How founders read a security audit report — and the red flags of a bad one.
The pre launch checklist SaaS founders need: 15 checks across security, reliability, performance, and monitoring, each with a self-test you can run now.
Score your app out of 100 across security, reliability, performance and monitoring. A self-scoring launch readiness checklist for SaaS founders.
Security audit costs in 2026: $0 free scans, $499 audit reports, low-thousands consultant reviews, five-figure pen tests. Full price table inside.
69 plain-English AI security terms for founders. RLS, anon keys, prompt injection, Article 50 - what each means and why it can sink a launch.