Across the 700-plus vibe-coded apps Launch Ready Code has scanned, the average Launch Readiness Score is 42 out of 100 — the most common failures being exposed API keys, Supabase Row Level Security left off, and no rate limits on authentication endpoints. This blog covers the specific CVEs, platform-specific misconfigurations, and security patterns behind those failures, with actionable fixes ranked by severity and the platforms most likely to ship each flaw.
Methodology: OWASP Top 10 · MITRE CWE Top 25 · CVSS v3
A look across the apps we've scanned (Mar–Jun 2026): most vibe-coded apps shipped at least one P0, and few were launch-ready. Platform-by-platform breakdown inside.
In May 2025, 170+ Lovable apps had Supabase row-level security disabled. No login. No exploit. One anonymous REST call returned the entire user database — emails, payment records, private content. Here is the technical breakdown, the attack vector, and the fix.
Quittr hit $1M in 10 days. Then 39,000 sobriety journals became publicly readable. One Firebase rule. Three lines to fix. The full technical breakdown.
The MCP rules say authorization is OPTIONAL, so a server with no sign-in is still a correct server. The obvious shortcut — reusing the token your web app already issues — is the one thing the rules forbid by name. Why the July 2026 revision moved an ownership check into your own tool code, and six checks you can run in a minute.
An AI tool names a package that was never published. An attacker claims the name and waits. The code runs at install time, before you ship anything — and a known-flaw scanner has nothing to match it against. Why 127 names were invented by all five frontier models tested in 2026, why Python is now the worse side, and the six checks that actually catch it.
Lovable, Bolt.new, Cursor, Replit, Claude Code, Windsurf, v0.dev, and Copilot compared on secrets, database rules, rate limits, and headers.
Every VITE_ variable in your Bolt.new app ships to the browser by design. Which keys are safe, how to move secrets to edge functions, how to check.
Bolt.new builds browser-first, so keys leak into the bundle and RLS stays off. Audit your live app free in 30 seconds before you launch.
Claude Code writes clean code, but your shipped app can still leak secrets and skip rate limiting. Audit your live app free in 30 seconds before launch.
Copilot suggests code it learned from public repos, unsafe habits included. The patterns that carry in, the deploy gaps it cannot see, and a free 30-second scan.
Cursor writes the code, but you own the deploy. What a Cursor security audit checks, the .cursorrules tell, and how to scan your live app free.
Cursor vs Copilot security is a tie: both write working code and skip the deploy work. What each tool leaves open, and the checklist that closes it.
Lovable wires up Supabase for you. It does not turn on RLS, keep keys out of the bundle, or add rate limits. Audit your live app free in 30 seconds before you launch.
Replit handles TLS and the servers. Rate limits, headers, database rules, and secrets are yours. The split, the checklist, and a free 30-second scan.
Replit fixed its agent after the 2025 database deletion. Your shipped app is still your job. Scan your live URL free in 30 seconds before launch.
v0.dev writes your UI. It does not guard your keys. NEXT_PUBLIC_ leaks, server vs client components, and headers on Vercel — plus a free 30-second scan.
Windsurf writes the code, but you own the deploy. What a Windsurf security audit checks, the .windsurfrules tell, and how to scan your live app free.
Bolt.new ships apps fast. Supabase RLS is off by default, secrets end up in client code, and auth routes are unprotected. Here is what to audit before you launch.
Cursor tab completions propagate insecure patterns from your codebase. Secrets end up committed. No PR review step before deploy. Here is the security checklist.
Replit makes deployment invisible and that invisibility hides real security gaps. Secrets tab vs hardcoded env, public repls exposing source, no rate limiting.
Supabase RLS, exposed API keys, missing rate limiting, absent CSRF protection. What a Lovable audit checks, what it typically finds (avg ~44/100), and a pre-launch checklist for every app.
Bolt.new builds full-stack apps fast. Authentication middleware, rate limiting, CSRF protection, and HTTP security headers require manual implementation. What a Bolt audit checks and what it finds.
Lovable is safe to build with — not always safe to launch blind. The honest 2026 answer on Lovable security, the CVE-2025-48757 RLS flaw, common gaps, and how to check your app in 60 seconds.
Four-step framework for auditing AI-generated code before launch: secret scanning, dependency review, SAST, and runtime header checks. OWASP A01/A07, CWE-200, CWE-798, CWE-89, CWE-94, CVE-2025-48757.
v0 generates Next.js UI. NEXT_PUBLIC_ variables, missing server-side auth, absent rate limits, and no CSP are the four gaps most v0 apps ship with. A step-by-step pre-launch audit guide.
Copilot suggestions inherit insecure patterns from public training data. SQL injection, hardcoded secrets, missing rate limits — the class-by-class audit guide for Copilot-assisted apps.
CVE-2025-66032 (CVSS 8.1, fixed in Claude Code v1.0.93) allowed arbitrary code execution via malicious context injection. What else to audit in Claude Code–built apps before launch.
Eight steps to secure a Lovable-built app: enable RLS on every table, move secrets to environment variables, enforce auth on routes, add rate limiting, set security headers, sync to GitHub, add error tracking, and scan your live URL.
Bolt.new is not a framework. It is an AI coding agent that generates apps using standard frameworks. What it outputs and what the security implications are.
The 20-item production readiness checklist for Lovable apps. Security, reliability, performance, and monitoring checks specific to Lovable and Supabase.
The complete security guide for Windsurf (Codeium) apps. What Windsurf generates, where the security gaps are, and the step-by-step process to close them before launch.
Claude Code is Anthropic's terminal-based AI coding agent. What it does, how it differs from Cursor and Copilot, and the security considerations for Claude Code projects.
Devin plans, writes, and opens pull requests on its own. The autonomy risks to check — unsupervised merges, exposed keys, prompt injection — before you trust it with production code.
Codex reads your repo, edits files, and can open pull requests. The sandbox and approval settings that keep that safe, and the checklist before you ship.
Lovable defaults to Supabase with RLS. Bolt.new ships faster but skips the hardening. The founder checklist for both, before real users arrive.
Both ship a working SaaS fast. Neither one locks down your database or your secrets for you. The checklist that closes the gap on either platform.
All three sell compliance automation. None of them check your Supabase RLS, your GDPR data map, or your EU AI Act disclosure. Here's what to actually budget for.
N+1 queries and missing indexes are the two most common database performance issues in AI-built apps. The checklist to find and fix both before launch.
Firebase ships in test mode: allow read, write: if true. Most vibe-coded apps launch that way. How to write owner-scoped rules before someone finds you.
Lovable wires Supabase for you. It does not lock it down. Where RLS fits, why the anon key is not the leak, and what CVE-2025-48757 proved.
Naive RLS policies re-run auth.uid() on every row. Wrap it in a select, index your policy columns, and your Supabase queries get fast again. Here is how.
The Supabase anon key is meant to be public. The service_role key never is. Here is which belongs where, and why RLS is what actually protects your data.
Supabase Auth ships with soft defaults: no forced email checks, long JWT life, open redirects. The 7-point checklist vibe-coded apps skip before launch.
AI editors scaffold Supabase edge functions that run but skip real auth. What JWT checks, service role handling, and CORS need before you launch.
Supabase storage security in plain English: public vs private buckets, storage policies that mirror RLS, signed URLs, and the mistakes that leak files.
The four Supabase security layers that fail most often: RLS policies, service_role key exposure, Edge Function auth, and Storage bucket permissions. Includes three diagnostic SQL queries you can run right now.
How to check if your Supabase Row Level Security is correctly configured — including the three SQL queries that diagnose disabled RLS, missing policies, and the dangerous USING (true) pattern.
RLS policies are the single line between private and public data in vibe-coded SaaS. The two silent failure modes — and how to fix them before users arrive.
What API rate limiting stops, where to add it first, copy-paste setups for Express, Next.js and FastAPI, and how to test yours with a burst.
Rotate first, then find the leak, then check for abuse, then move the call server-side. Exact rotation steps for Stripe, Supabase, and OpenAI keys.
Six security headers, each one's job in one sentence, and copy-paste configs for Vercel, Netlify, Render, and Cloudflare. Check yours free in seconds.
Supabase and most AI builders keep your login JWT in localStorage by default. Any script on your page can read it. Here is where to store it safely.
When your app throws a CORS error, the AI tells you to set Access-Control-Allow-Origin to a wildcard. On a logged-in endpoint, that one line lets any website read your users’ data. Here is what our scanner flags at 0.99 confidence — and the safe four-step fix.
Some keys are built to be seen. Some are a breach in plain sight. The mental model that separates pk_live from sk_live, the anon key from service_role.
Most vibe-coded apps carry hardcoded API keys, tokens, and credentials baked into their AI-generated bundles. Here is how to find and fix them before launch.
Lovable apps ship API keys to the browser by default. The 5 practices that secure Lovable API keys without slowing your launch — starting with a free scan.
Your AI builder wired the schema, not the recovery plan. What platforms back up by default, and the restore test everyone skips.
Most founders learn about crashes from support email. That is too late. What to track — errors, uptime, slow queries — and how to set it up in month one.
From 1 October 2026 the state bans the sale of precise location data outright — no consent option, no size test, and only two carve-outs. Why the scope change actually happened three months earlier, why “monetary or other valuable consideration” catches ad-SDK deals founders never call a sale, why the regulator’s own notice still cites a revenue threshold that no longer exists, and the definition numbers that all shift by one.
Connecticut’s privacy law names a number — 35,000 users — and most founders stop reading there. For health data that number has never applied, and since 1 July 2026 it does not apply to any sensitive data either. Two doors into the same law, the new privacy-notice line about training large language models, why tracking pixels are how the state actually finds you, and what changes again on 1 October 2026.
Nevada’s law has no revenue test and no user minimum, and the version that passed is not the version most summaries describe. Health data is defined by what a firm uses data to work out, not by what it stores — so a shopping history becomes health data the moment a model guesses at a diagnosis. Why the HIPAA carve-out closed the opposite way round, why the consent rules were deleted by amendment, and why 1,750 feet means three different things.
No revenue test, no user-count test, and a route to private claims that no other US state privacy law offers. Why a HIPAA business associate agreement exempts your records and not your company, why a step count or a model’s guess is health data, why the policy link belongs on every page with a form, and why one consent is never enough.
California asks about revenue. Colorado, Connecticut and Virginia never do — they count rows, and free users count. Why “sale” means one thing in Virginia and another in California, why precise coordinates are sensitive data inside a 1,750 foot radius, and why honouring one state’s opt-out signal does not cover you in the next.
Revenue is only one of three tests, and the third has no floor at all. What “sharing” means when no money changes hands, why a “Do Not Sell or Share” link does not discharge the duty, and the one header — Sec-GPC — that no AI coding tool has ever written a handler for.
Under 250 staff does not let you off. Article 30(5) falls away the moment your processing is “not occasional” — which a product with user accounts always is. The two records you owe, why you build them from your schema rather than from memory, and why the register is what makes a 72-hour breach report possible.
Ask an AI coding tool to add delete and it very often writes an update that hides the row, not one that removes it. Why a deleted_at flag, a missing cascade and an RLS policy all fail Article 17 — plus every other place one user still lives, and what the ICO actually expects of your backups.
Your AI coding tool picked the vendors and their default region, so you own a data flow you never designed. How to find every transfer out of the EEA in your own config, packages, webhooks, logs and vendor pages — and what Chapter V asks of each one.
Ask an AI tool to add analytics and it pastes the script into the page head, where it sets cookies before any banner exists. What ePrivacy Article 5(3) and GDPR require, a ten-minute DevTools audit, and three ways to gate the scripts.
Article 25 names four defaults your code must set: how much data you collect, how far you process it, how long you keep it, and who can reach it. AI-written code ships the opposite of all four. Here is the code-level checklist.
When Article 35 makes you do a Data Protection Impact Assessment, the four things it must contain, how it differs from the EU AI Act FRIA, and why an AI-built app has to build it from the real code.
You can't report a breach you can't detect. What Article 33 requires in 72 hours, what Article 34 adds, and the logging an AI-built app needs before the clock starts.
A customer files a GDPR access request. Your AI-built app has no data map. The Article 15 deadline, what to send, and where the data actually hides.
Lovable, Bolt, and Cursor can process user data while they build. Here's when GDPR Article 28 requires a signed DPA, and what to do if a vendor won't sign one.
No major AI coding tool signs a Business Associate Agreement, and Lovable’s own terms ban uploading PHI. What that means before real patient data touches your app.
The four risk tiers in plain English and a ten-minute decision path. Most SaaS products land in limited risk — one duty, enforceable from August 2, 2026.
Your database tech is visible from DNS alone. Ten post-launch hardening steps with copy-paste SQL: RLS on every table, locked buckets, rate limits, tested backups.
Enterprise buyers now ask if AI wrote your code. What the form really tests, the honest answer that keeps the deal, and a one-week plan to send it back.
Big buyers, auditors, and the EU AI Act all ask for the same document. The seven sections your AI policy needs, and a plan to ship it this week.
EU AI Act fines run three tiers, not one number. Which tier your SaaS faces, why Article 50 matters, and what to fix before August 2, 2026.
GDPR data mapping when an AI wrote your code: find where personal data lives, list your vendors, set retention, and build your Article 30 record.
ISO 27001 for startups, in plain words: what the standard covers, why AI-built code fails the audit, what prep costs. We prep. We do not certify.
SOC 2 is a CPA-issued report, not a badge you buy. What auditors ask about AI-generated code, what prep costs, and how to get ready. We prep, not certify.
What SOC 2's CC7.1 control actually requires, why AI-built apps fail it by default, and the practical remediation workflow auditors expect to see.
Nessus scans internal networks. A Lovable, Bolt, or Cursor app has none. What a URL-based vulnerability scanner should check instead, and where founders usually go wrong.
The vibe coding compliance checklist for AI-built apps: GDPR basics, EU AI Act Article 50, SOC 2 readiness, privacy policy, and data retention.
Check Lovable, Bolt.new, or Cursor apps for data handling, consent, and EU AI Act overlap — no code access needed. The gaps AI builders leave behind.
Enforcement begins August 2, 2026. Know your risk tier and the three fixes to make before the deadline — written for founders, not lawyers.
Article 50 requires AI chatbots and assistants to disclose they are AI. A full compliance guide with copy templates and compliant examples.
Sprinto Year-2 renewals run 30–40% above Year-1 pricing. Before you renew, audit what you actually need — and whether the increase is worth it.
Detectify starts near $249 a month and was built for security teams. Five options for indie founders, priced and compared — and the flaw class every generic scanner misses.
OWASP ZAP, Postman, 42Crunch, and Burp Suite compared for API security testing — and the BOLA gap none of them catch alone.
Fortify is big-company SAST built for big AppSec teams. Why it is the wrong fit for a Lovable, Bolt, or Cursor build, and what actually catches the risk.
Exposed secrets and a leaky Supabase table are now common findings before a seed or Series A round. What investors check, and how founders fix both before the data room opens.
Automated pentesting and a real penetration test are not the same thing. What each one actually checks, what it costs, and which one a founder needs before launch.
A fractional CTO runs $2k–$5k a month. A full-time senior hire runs $180k+ a year. What each actually covers, and when to pick which one.
OWASP ZAP and other open source DAST tools are free and catch real bugs. What they cannot see: an access-control gap that still returns a normal 200. Where free tools end and a done-for-you audit begins.
Supabase the platform is safe. Row Level Security ships off by default on every table. Here is the honest split between what Supabase secures for you and what you must configure yourself.
Semgrep, Snyk, gitleaks, and Trivy catch real bugs in your code before it ships. None of them can see a disabled Row Level Security rule or a missing rate limit — those live in your runtime settings, not your source.
Why is AI generated code insecure? The models are graded on code that runs, not code that resists attack. The failure modes, dimension by dimension.
The best vibe coding security tools by category: secret scanners, dependency checkers, headers checkers, and URL-based readiness scans. Free first.
P0 to P3 severity, CVSS vs real risk, and a week-by-week fix plan. How founders read a security audit report — and the red flags of a bad one.
The pre launch checklist SaaS founders need: 15 checks across security, reliability, performance, and monitoring, each with a self-test you can run now.
Score your app out of 100 across security, reliability, performance and monitoring. A self-scoring launch readiness checklist for SaaS founders.
Security audit costs in 2026: $0 free scans, $499 audit reports, low-thousands consultant reviews, five-figure pen tests. Full price table inside.
69 plain-English AI security terms for founders. RLS, anon keys, prompt injection, Article 50 - what each means and why it can sink a launch.
Snyk scans dependencies and code. AI code auditing scans what your app exposes after deployment. The complete breakdown of what each covers, when to use which, and how to combine them.
Every developer shipping software in 2026 needs to understand security. AI coding tools democratize app creation — they also democratize the attack surface. Why cybersecurity is now a core skill.
Checkmarx One is an enterprise application security platform combining SAST, SCA, DAST, and IaC scanning. What it does, what it costs, and the alternatives.
Intruder scans infrastructure. Launch Ready Code audits AI-built apps across 4 dimensions. Exactly what each one covers and when to use which.
Launch Ready Code is an AI-built app readiness scanner, not a general security auditing tool. Exactly what it checks, what it does not, and when to use it versus alternatives.