Security for AI-built apps
Vibe-coded apps ship in hours, but the security basics —exposed secrets, missing database rules, open CORS, absent headers— get skipped along the way. This guide explains the flaws that actually bite AI-built apps, how to check for them in 30 seconds, and where to go deeper for your stack.
What "vibe coding security" means
AI tools build apps where the browser talks directly to your database and services. That is convenient, but it moves security from your code to your configuration: what protects you are the database rules, the headers and which keys live where — not the pretty interface code.
The problem is that those pieces are not set up correctly by default, and the AI rarely configures them for you. The result: apps that look perfect but expose data or keys to anyone who knows where to look.
The flaws that bite AI-built apps most
API keys in the browser: when you "connect" a service, the key ends up in client JavaScript, where it is public forever.
Missing or weak database rules: without proper Row-Level Security (Supabase) or with rules in test mode (Firebase), anyone reads and writes your tables without logging in.
Permissive CORS: a policy that reflects any origin with credentials exposes your users' data.
Missing security headers: without CSP, HSTS or X-Frame-Options, your app is open to clickjacking, injection and downgrade.
Accessible sensitive files: .env, source maps or backups that let anyone rebuild your code or leak secrets.
The app "looking fine" does not mean it is safe
Hiding a button in the interface protects nothing: the request is still a public URL anyone can call directly. Real security lives on the server and in the database, not in what the user sees. That is why checking from the outside —the way an attacker would— is the only way to know what is actually exposed.
How to check it in 30 seconds
Scanaris scans your published site read-only: it never touches your code or changes anything. It detects these flaws, ranks them by impact (critical first) and gives you a ready-to-paste AI fix prompt for every finding. Paste your URL and know for sure before you share your app.
Go deeper for your stack
Next.js
Security for your Next.js app
Supabase
Security for your Supabase app
Firebase
Security for your Firebase app
Vercel
Security when deploying to Vercel
Lovable
Security and visibility for your Lovable app
Bolt
Security for your Bolt app
v0
Security for your v0 app
Replit
Security for your Replit app
Cursor
Security for the code you write with Cursor
Key security checks
Related guides
Frequently asked questions
Is my Lovable, Bolt or Cursor app secure?
It can be, but by default it usually ships with keys in the frontend, incomplete database rules and no security headers. The only way to know is to check your published site: Scanaris does it in 30 seconds, read-only.
Is scanning my site dangerous for it?
No. Scanaris runs read-only checks on already-public information (headers, cookies, certificates, accessible files). It never modifies, deletes or injects anything. You should only scan sites you own or are authorized to test.
Do I need to know security to use it?
No. Every finding comes with a clear explanation and a ready-to-paste AI fix prompt, so you can solve it without being an expert.