Sentrint Blog

Working is not the same as safe

Lovable, Bolt, v0 and Cursor all ship apps with the same handful of holes, and none of them throw an error. One guide per tool, per question.

AI-built apps · Checklist

Six security checks you can run on your own SaaS in 15 minutes

The same mistakes show up in almost every app built fast. Six checks, no tools needed, each with the command to run and what a failure looks like.

· 8 min read · Gourab Dasgupta

Six checks, none of which need a tool: row-level security off, a policy that allows everything, secrets in NEXT_PUBLIC_ or VITE_ variables, auth that only runs in the browser, .env in git history, and a webhook with no signature check. Numbers one and four cause most of the breaches you read about.
The running order 22 guides, newest first
01 Why AI-generated code keeps shipping XSS, and the four places it hides AI-built apps · 5 min 02 A v0 security checklist for the Next.js app you just exported v0 · 5 min 03 Supabase RLS: test grants, policies and user access AI-built apps · 8 min 04 Six security checks you can run on your own SaaS in 15 minutes AI-built apps · 8 min 05 Write a security rules file once, and every prompt inherits it AI-built apps · 5 min 06 Deleting the key from the file does nothing. It is still in your git history AI-built apps · 5 min 07 Your app calls an LLM. Everything your users type is now instructions AI-built apps · 5 min 08 Your paywall is a CSS rule. Here is what it costs and how to fix it AI-built apps · 5 min 09 The package was real, popular and compromised. Your agent installed it anyway AI-built apps · 4 min 10 A Lovable security checklist you can finish in an evening Lovable · 5 min 11 Is v0 safe? The generated code is the whole question v0 · 5 min 12 Is Replit safe? Security checks for your app Replit · 4 min 13 Is Lovable safe? What its security scans cover, and what is still yours Lovable · 4 min 14 Is Cursor safe? The editor and the code it writes are two questions Cursor · 5 min 15 Is Bolt safe? The platform is certified. Your app is not covered by that Bolt · 5 min 16 Is Base44 safe? Security checks before you launch Base44 · 5 min 17 Your AI invented a package name. Someone else registered it AI-built apps · 6 min 18 Every MCP server you added is code you never read Cursor · 5 min 19 Can one of your users read another user's data? Here is how to find out AI-built apps · 6 min 20 A Bolt security checklist for the hour before you share the link Bolt · 5 min 21 API key exposed in your frontend? How to find it and fix it AI-built apps · 6 min 22 What the research actually says about AI-generated code security AI-built apps · 5 min

All guides

22 published
AI-built apps Vulnerabilities

Why AI-generated code keeps shipping XSS, and the four places it hides

Georgetown's CSET found XSS in 86% of AI-generated samples. React escapes output everywhere except the four spots a model reaches for to render rich text. · 5 min read v0 Checklist

A v0 security checklist for the Next.js app you just exported

v0 writes idiomatic Next.js, so it fails the way Next.js fails: authorisation in middleware, server actions with no caller check, secrets in client code. · 5 min read AI-built apps Guide

Supabase RLS: test grants, policies and user access

Grants and RLS policies are separate checks. Learn default-deny behavior, safe insert policies, view permissions, and how to test access in Supabase. · 8 min read AI-built apps Checklist

Six security checks you can run on your own SaaS in 15 minutes

The same mistakes show up in almost every app built fast. Six checks, no tools needed, each with the command to run and what a failure looks like. · 8 min read AI-built apps Guide

Write a security rules file once, and every prompt inherits it

CLAUDE.md, AGENTS.md and .cursorrules are read on every request. A copy-paste security rules file, and the four rules worth putting in it. · 5 min read AI-built apps How to secure it

Deleting the key from the file does nothing. It is still in your git history

A secret committed once stays in every clone, fork and CI cache until you rotate it. Rotate first. Rewriting history is cleanup, and it comes second. · 5 min read AI-built apps Risks

Your app calls an LLM. Everything your users type is now instructions

If your app sends user text to a model, the model can't tell it apart from your prompt. Better wording won't fix that. Limiting what it can reach will. · 5 min read AI-built apps Vulnerabilities

Your paywall is a CSS rule. Here is what it costs and how to fix it

Hiding a premium feature is presentation. Checking the plan is authorisation. Generated apps usually do only the first, and devtools shows the gap. · 5 min read AI-built apps Risks

The package was real, popular and compromised. Your agent installed it anyway

Shai-Hulud steals npm, GitHub and cloud tokens through postinstall scripts, then republishes itself. In August 2026 it reached keyv and 400+ packages. · 4 min read Lovable Checklist

A Lovable security checklist you can finish in an evening

Nine checks for a Lovable app before real users arrive. What to click, what a failure looks like, and a prompt to paste back into Lovable to fix it. · 5 min read v0 Is it safe?

Is v0 safe? The generated code is the whole question

v0 gives you React and Next.js code that you deploy, so more of the security is on you than with a hosted builder. The four checks that matter most. · 5 min read Replit Is it safe?

Is Replit safe? Security checks for your app

Replit's agent once deleted a live database. Replit now separates dev and production and scans code before publishing. What to check in your own app. · 4 min read Lovable Is it safe?

Is Lovable safe? What its security scans cover, and what is still yours

Lovable now runs a free scan on every publish and a free Deep scan of your code. What each checks, when that is enough, and what is still yours to test. · 4 min read Cursor Is it safe?

Is Cursor safe? The editor and the code it writes are two questions

Cursor has had three rounds of remote code execution flaws, all patched, all needing you to open something hostile. Nobody audits the code it writes. · 5 min read Bolt Is it safe?

Is Bolt safe? The platform is certified. Your app is not covered by that

Bolt is SOC 2 Type 2 certified and offers a free security audit before publish. What that audit checks, and what you still have to test in your own app. · 5 min read Base44 Is it safe?

Is Base44 safe? Security checks before you launch

Base44 fixed two serious platform flaws in 2025 and now ships its own security scan. What that scan checks, and what you still have to test in your app. · 5 min read AI-built apps Vulnerabilities

Your AI invented a package name. Someone else registered it

An LLM invents a dependency that doesn't exist, and an attacker registers that exact name. One fake package reached 237 repositories. How to check yours. · 6 min read Cursor Risks

Every MCP server you added is code you never read

An MCP server describes its own tools and your agent trusts the description. Two Cursor CVEs came from that, and the general problem isn't a bug to patch. · 5 min read AI-built apps Risks

Can one of your users read another user's data? Here is how to find out

Broken object level authorisation is the most common serious flaw in AI-built apps, and testing your own account never finds it. A 20-minute test. · 6 min read Bolt Checklist

A Bolt security checklist for the hour before you share the link

Eight checks for a Bolt app, in the order an attacker would find them. Most take two minutes with a browser, a second account and your Supabase dashboard. · 5 min read AI-built apps Vulnerabilities

API key exposed in your frontend? How to find it and fix it

A key in your browser bundle is public. Which keys are meant to be there, how to find the rest in a live app, and how to rotate and move them server-side. · 6 min read AI-built apps Guide

What the research actually says about AI-generated code security

Eleven numbers people quote about AI code security, what each study measured, and which survive a look at the method. Updated as new research lands. · 5 min read