// SECURITY TOPICS
The security holes AI-built apps leak through.
Each one explained in plain English: what it is, how to tell if your app has it, how it happens in AI-built apps, and exactly how to fix it.
- How do I know if my Supabase database is exposed?A non-developer test for whether strangers can read your Supabase tables: the anon key is fine, but Row Level Security is the real gate. Here is how to check.
- How to check for exposed API keysAn exposed API key is a secret anyone can read from your app. Here is where AI tools leak them, how a non-developer can find theirs, and how to rotate and fix it.
- Can someone hack an app built with AI?Yes, but not the way you picture it. The realistic threat to AI-built apps is automated scanning for exposed keys and open databases, not elite hackers targeting you.
- Exposed API keys & secrets in the browserAI coding tools often ship secret API keys into the browser, where anyone can read them. Here is what that means, how to check your app in two minutes, and how to fix it.
- Public databases & missing Row-Level SecurityIf Row-Level Security is off, anyone with your public key can read your whole database. Here is what RLS is, how to tell if your app is exposed, and how to lock it down.
- Broken access control / IDOR (reading other users’ data)IDOR lets a user change an id in a URL or request and read someone else’s data. Here is what it is, how to test for it, and how to fix it in an AI-built app.
- Fake "payment succeeded" / unverified webhooksIf your payment webhook does not verify its signature, anyone can fake a "payment succeeded" event and unlock paid features for free. Here is how to check and fix it.
- Public file storage / leaked uploadsA public storage bucket exposes every file your users upload, often with no link required. Here is how to tell if yours is open and how to make it private.
- SQL injection, in plain EnglishSQL injection lets an attacker rewrite your database query by typing into a form. Here is what it is in plain English, whether AI-built apps are at risk, and how to prevent it.
- Weak or missing authenticationWhen the "are you allowed?" check runs in the browser, the visitor holds the key. Here is how broken auth shows up in AI-built apps and how to fix it.
- Missing security headers & open CORSMissing security headers and a wide-open CORS policy let other sites attack your users. Here is what they are, why they matter, and the safe settings.
- The Lovable RLS exposure explained (CVE-2025-48757)CVE-2025-48757 exposed 170+ Lovable-built apps because Row-Level Security was off by default. Here is what happened, whether your app is affected, and how to fix it.
- Why ~45% of AI-generated code ships insecureVeracode’s 2025 research found AI models pick the insecure way to write code 45% of the time. Here is what that means for your app and what to do about it.