I built a typical AI-generated app and scanned it. It had 5 critical security holes before I touched a line of code.

A 5-minute guide to checking whether your Lovable / Bolt / Replit app is leaking your users' data, and why it probably is.

I've been fixing apps built with AI tools like Lovable, Bolt, Replit, and Cursor, and the same handful of serious security holes shows up in almost every one. Not because the founders did anything wrong, but because the tools optimize for "make the demo work," not "keep your users' data safe."

To show what I mean, I built a small task manager the way a non-technical founder would: describe it to the AI, wire up Supabase for the database and login, ship it. Standard stack, standard prompts. Then I ran a security pass over it.

Five critical issues. Plus three more. Before I had written any code myself.

And this isn't just my one demo app. When Escape.tech scanned 5,600 real production apps built this way, 1,400 had vulnerabilities and they found over 400 leaked secrets. A separate audit of 200+ apps found 91.5% had at least one AI-generated security flaw. This is the norm, not the exception.