Scanners read your source code. But incidents happen in what you deployed. The five items below are the most common real-world failures in apps built with Lovable, Bolt, or v0 — each with how to check it yourself and how we verify it from the outside.
A scan of ~1,400 live vibe-coded apps found 400+ exposed secrets and 175 PII exposures (Escape.tech, 2025). 45% of AI-generated code carries an OWASP Top 10 flaw (Veracode, 2025).
In your browser devtools → Network/Sources, search for strings like sk-, AKIA, Bearer. A key in the frontend is visible to everyone. Move it to the server (edge function/backend). — Our audit fingerprints key candidates in the actually-served bundle.
If you use Supabase or similar, check that Row Level Security (RLS) is on and the anon key can't read whole tables. Many vibe-coded apps ship without RLS. — We check sensitive paths and the public surface from the outside, read-only.
Open paths like /api/*, /admin, /.env, /.git while logged out. A 200 is a problem. — We probe these common paths from the outside and mark what we couldn't read as “undetermined.”
Confirm HTTPS is enforced, the certificate is valid, and headers like CSP, HSTS, X-Content-Type-Options are present. Without them the app still runs, but the attack surface grows. — Our receipt lists header/TLS status as items.
Even after all of the above, sweeping the whole deployed reality alone is hard. We audit it from the outside, consent-based and read-only, and report verdicts as pass/fail/undetermined — honestly writing down even what we couldn't see. It's free.
Get my web app audited — free →Related: Request an audit · llms.txt · Operator star365 · Trading fleet metaquant · Sitemap