Scanning 5,600 Lovable/Bolt apps found 400 leaked secrets and 175 leaking customer data
Warm-Reaction-456 · reddit · 2026-09-07
A dev-shop owner explains, in plain terms for non-technical founders, what "production-ready" actually means: an app that survives strangers, bad wifi, Stripe outages, and attackers — not just your own happy-path clicking.
- Case study: a founder built a product with Lovable + Supabase + Stripe, 40 paying customers, and one customer could see another company's invoices in his dashboard. Lovable claimed a fix that didn't stick; a paid freelance "security review" had signed off anyway.
- Checklist (ordered by self-check speed):
- Keys in the browser — search source and network tab for sklive / servicerole (the Supabase anon key is fine, it's meant to be public). A recent scan of 5,600 live Lovable/Bolt/Base44 apps found 400 exposed secrets and 175 apps leaking customer data, some medical.
- Failure alerting — AI-built apps often show a green tick while the DB write silently failed; ask "if Stripe goes down at 3am, how do we find out?"
- Backups you've actually tested — cheap Supabase plans only keep a few days; have your dev restore last night's backup into a scratch project (20 minutes).
- Staging and rollback.
- The author argues the problem is getting worse as models improve (Fable 5.1, GPT-6 Astra, Lovable's $13B raise), because more non-engineers are shipping real services.
More from coding & agent
- He benchmarks new models by having them build their own copilot — $28 of compute — bucolucas · 2026-10-27
- Founder generates 46 app promo videos in 4 days with Claude, skipping $11,500 in UGC fees — PrajwalTomar_ · 2026-10-27
- Should agents be allowed to change plans mid-task? Reddit debates the drift boundary — wistfulcracker84 · 2026-10-27
- HeyGen + Canva MCP turns slide speaker notes into an avatar presentation video — HeyGen · 2026-10-27
- Local beats cloud: Qwen 3.8 FN handles private student data as well as frontier models — dr_lm · 2026-10-27
- Cloudflare Computer adds agent interruption recovery and approval pauses in v0.7.0 — irvinebroque · 2026-10-27