Scanning 5,600 Lovable/Bolt apps found 400 leaked secrets and 175 leaking customer data

Warm-Reaction-456 · reddit · 2026-09-07

A dev-shop owner explains, in plain terms for non-technical founders, what "production-ready" actually means: an app that survives strangers, bad wifi, Stripe outages, and attackers — not just your own happy-path clicking.

Case study: a founder built a product with Lovable + Supabase + Stripe, 40 paying customers, and one customer could see another company's invoices in his dashboard. Lovable claimed a fix that didn't stick; a paid freelance "security review" had signed off anyway.
Checklist (ordered by self-check speed):
Keys in the browser — search source and network tab for sklive / servicerole (the Supabase anon key is fine, it's meant to be public). A recent scan of 5,600 live Lovable/Bolt/Base44 apps found 400 exposed secrets and 175 apps leaking customer data, some medical.
Failure alerting — AI-built apps often show a green tick while the DB write silently failed; ask "if Stripe goes down at 3am, how do we find out?"
Backups you've actually tested — cheap Supabase plans only keep a few days; have your dev restore last night's backup into a scratch project (20 minutes).
Staging and rollback.
The author argues the problem is getting worse as models improve (Fable 5.1, GPT-6 Astra, Lovable's $13B raise), because more non-engineers are shipping real services.

Original post →

Scanning 5,600 Lovable/Bolt apps found 400 leaked secrets and 175 leaking customer data

More from coding & agent