Scanning 5,600 Lovable/Bolt apps found 400 leaked secrets and 175 leaking customer data
Warm-Reaction-456 · reddit · 2026-09-07
A dev-shop owner explains, in plain terms for non-technical founders, what "production-ready" actually means: an app that survives strangers, bad wifi, Stripe outages, and attackers — not just your own happy-path clicking.
- Case study: a founder built a product with Lovable + Supabase + Stripe, 40 paying customers, and one customer could see another company's invoices in his dashboard. Lovable claimed a fix that didn't stick; a paid freelance "security review" had signed off anyway.
- Checklist (ordered by self-check speed):
- Keys in the browser — search source and network tab for sklive / servicerole (the Supabase anon key is fine, it's meant to be public). A recent scan of 5,600 live Lovable/Bolt/Base44 apps found 400 exposed secrets and 175 apps leaking customer data, some medical.
- Failure alerting — AI-built apps often show a green tick while the DB write silently failed; ask "if Stripe goes down at 3am, how do we find out?"
- Backups you've actually tested — cheap Supabase plans only keep a few days; have your dev restore last night's backup into a scratch project (20 minutes).
- Staging and rollback.
- The author argues the problem is getting worse as models improve (Fable 5.1, GPT-6 Astra, Lovable's $13B raise), because more non-engineers are shipping real services.
More from coding & agent
- LLM-powered revival of Put-That-There brings speech and gesture window control to XR — twi_mar · 2026-09-07
- 18-year-old dev builds post-apocalyptic Godot game scene via Blender MCP in half a day — majidmanzarpour · 2026-09-07
- Anthropic Claude Code engineer on internal AI coding practices and autonomy share — trq212 · 2026-09-07
- Leak: OpenAI to unveil Managed Agents at DevDay 2026 with hosted or self-hosted deploy — testingcatalog · 2026-09-07
- Harness-only changes lift deepagents-cli from 52.8% to 66.5% on Terminal-Bench 2.0 — Gauri_the_great · 2026-09-07
- Chops: open-source macOS app to manage AI agent skills across Claude Code, Cursor, Codex — tom_doerr · 2026-09-07