What I found when I security-scanned 10 AI-built apps (and how to check yours manually)

AI coding agents — Lovable, bolt.new, Cursor, Replit — have made it possible

for anyone to ship a working app without writing a line of code themselves.

That's genuinely great. It also means a huge and growing number of live apps

were never looked at by anyone who knows what a SQL injection or a missing auth

check looks like.