The vibe-coding security checklist
The issues that show up most often in apps built with Cursor, Bolt, Lovable, and v0 — in the order they tend to matter most.
Exposed API keys and secrets
Check every JavaScript bundle your app ships for OpenAI, Anthropic, Stripe secret, AWS, GitHub, or Supabase service_role keys. Public keys (Stripe publishable, Firebase config, Supabase anon) are safe by design — the ones above are not.
Read the full guideSupabase / Firebase authorization rules
A public anon key without enforced Row Level Security policies (Supabase) or security rules (Firebase) behind it means anyone can query your database directly, unauthenticated.
Read the full guideMissing security headers
HSTS, Content-Security-Policy, and X-Frame-Options are rarely set by default in scaffolded apps. Their absence makes clickjacking and downgrade attacks easier than they need to be.
CORS misconfiguration
Access-Control-Allow-Origin: * on an endpoint that returns authenticated data lets any website read it on a logged-in user's behalf.
JWT and session handling
Tokens that never expire, are stored insecurely, or are not verified server-side on every request are a common shortcut in AI-generated auth flows.
Exposed source maps and config files
.env, .git/config, and production source maps left publicly accessible hand an attacker your source code and, sometimes, your secrets directly.
Outdated dependencies with known CVEs
Scaffolded projects pin whatever version was current when the template was generated — that drifts out of date fast, and AI tools do not proactively flag known vulnerabilities in what they installed.
Rate limiting on auth endpoints
Login and signup routes with no rate limit are an open door for credential-stuffing and brute-force attempts.
Skip the manual checklist
StackSecured runs 33 automated checks against your live app — including every item above — and gives you plain-English findings with copy-paste fixes in about 30 seconds.
Run a free scanCommon questions
Is my Cursor, Bolt, Lovable, or v0 app secure by default?
+
Not typically. These tools optimize for a working feature, fast — security defaults like Row Level Security policies, rate limiting, and CSP headers require deliberate setup that nothing in the standard flow forces. Most first-scan security scores for AI-built apps fall between 45 and 75 out of 100.
Which of these issues matters most to fix first?
+
Exposed secret keys and missing database authorization (RLS/security rules) first — both let an attacker directly access money or data with no further effort. Headers, CORS, and rate limiting matter, but they raise the difficulty of an attack rather than handing over the keys outright.
Can I check all of this myself without hiring a security engineer?
+
Most of it, yes, with the right checklist — the individual checks above are mechanical (grep your bundle for key patterns, test one unauthenticated request against your database, check response headers). Automated scanning is faster and catches things manual review misses, like which of dozens of dependency CVEs actually apply to your specific versions.
More guides: Supabase RLS: the #1 vibe-coding bug · Exposed API keys in AI-built apps