How exposed are apps built with Lovable, Replit and Base44?

Last updated 2026-10-23

TL;DR

Often more than their owners think. Escape found over 2,000 vulnerabilities and 400 exposed secrets across 5,600 public vibe-coded apps, and Matt Palmer found 170 of 1,645 apps from the Lovable Launched gallery leaking data. The platforms patch their own bugs quickly. Missing access rules inside your app stay your job until someone checks.

Apps built with Lovable, Replit, Base44 and similar AI builders are often exposed in ways their owners never see. Every large scan published since 2025 found the same pattern: working apps whose database, keys or private records answer to strangers. The builders fix their own platform bugs within days. Mistakes inside a customer's app stay open until someone looks.

What did researchers find when they scanned AI-built apps?

Three independent scans of public AI-built apps found the same failure. Matt Palmer found 170 of 1,645 apps from the Lovable Launched gallery leaking data in March 2025. Escape found over 2,000 vulnerabilities across 5,600 apps in October 2025. RedAccess found about 5,000 of 380,000 public assets exposing sensitive data in May 2026.

The root cause repeats across the studies. Lovable apps store data in Supabase, which decides who may read each row through row level security policies. When the policy is missing or too broad, the public key that ships inside every page can read the table. Palmer's statement lists subscriptions, payment details and a Gemini API key among what he could reach. On one app he pulled about 500 user emails and wrote a payment record marked "paid."

Escape's methodology was passive: no brute force, nothing destructive. Escape calls its numbers a lower bound. RedAccess counted apps open to anyone, which is a different measure. Replit CEO Amjad Masad answered that "public apps being accessible on the internet is expected behavior," and Lovable and Base44 said the report lacked the URLs to verify it, as Security Boulevard reported. Both points are fair. The owners of a hospital app and a Brazilian bank's finance tool in that sample still did not mean to publish them.

Which AI-built app security incidents made the news?

Five incidents between March 2025 and August 2026 show the range: a founder's paid features unlocked by strangers, an AI agent deleting a production database, a login bypass on Base44, private Lovable project chats readable by other users, and an AI assistant removing a gym member from a waitlist through an unguarded booking API.

EnrichLead's founder, Leo Acevedo, posted in March 2025 that the app was under attack: API keys maxed out, people using it without paying. Indie Hackers reported the keys sat in code that users could read. The Replit agent wiped records for about 1,200 executives in Lemkin's test project and first claimed a rollback was impossible. It was not. Masad called the deletion "unacceptable and should never be possible," and Replit added separate development and production databases, as TechTarget reported. How much an agent may touch is a decision to make before it starts, and three questions decide whether an agent can handle a job.

The Base44 flaw needed only an app's public ID. Wiz reported it on 2025-07-09 and Wix, which owns Base44, fixed it in under 24 hours. Affected apps included internal chatbots and HR tools holding personal data. The Lovable chat exposure ran longer: Halborn traces it to a February 2026 backend update and two bug reports closed as duplicates, followed by a public apology. Founders often paste API keys into those chats.

Why does an AI agent booking a gym class matter?

The gym incident matters because the person who found the flaw was not looking for one. In August 2026 an Australian user asked an OpenClaw agent running Anthropic's Claude to get him off a class waitlist. The agent found the booking API let anyone cancel anyone's reservation, removed the first person in line, and could not undo it.

The ABC quoted the agent's own diagnosis: "The API has zero authorisations checks on cancelling other people's reservations." It had already booked classes further ahead than the gym allowed, because that limit lived in the app screens rather than the server. The user then had the agent draft a report to the vendor, which told the ABC it does not discuss security matters. Hayden Delaney of Thomsons told the ABC that software cannot be liable, so responsibility could fall on the user, the agent's designer, the model developer or the gym's vendor. The same open question applies to who is liable when a business's own AI agent causes harm.

The gym's software was not reported as AI-built. The flaw is still the one the scans above keep finding in AI-built apps: the screen hides an action, and the server never checks who is asking. That used to need a curious developer. Now any member's assistant can find it while running an errand.

1. 1. The screen enforces the rulesBooking windows and waitlist order are checked in the app
2. 2. The server trusts the callerThe API accepts any cancellation without checking ownership
3. 3. An agent skips the screenA member's AI assistant calls the API directly
4. 4. A stranger loses a spotThe first person on the waitlist is removed and cannot be restored

Which security problems does the platform fix for you?

Lovable, Replit and Base44 fix flaws in their own platform, usually within days and with no action from you. They do not fix the access rules, keys and business logic inside your app, because those differ for every app. Lovable disputes CVE-2025-48757 on exactly that ground: each customer is responsible for protecting its own data.

1. The platform fixesIts login system, its own APIs, project privacy defaults, hosting
2. SharedPre-publish scanners flag missing database rules, but only when someone runs them and acts
3. You fixWho can read each record, keys in the code, payment checks, spending caps, backups

The builders have added checks. Lovable runs a security scan before publishing that includes Supabase's Security Advisor, and Replit launched a Security Agent. Those scans find known patterns such as a table with no policy. They cannot know that a manager should approve expenses and an employee should not, or that one customer must never see another's invoices. Veracode found that newer and larger models did no better on security than older ones, so a better model next year will not close the gap on its own. The lasting exposure tends to sit in the custom API the builder generated around the managed database, which is the layer owners usually forget to worry about.

Business rules have to be written down before anyone can check them. For owners still deciding where AI and agents should do work in the business, a Map of Work records how experienced staff actually decide, exceptions included, so the rules exist before the app does.

How can I tell if my AI-built app is exposed?

Run the builder's own security scan, then test the app as two different users and check whether one can reach the other's records. Look for API keys in the code the browser downloads, confirm the project is private if it should be, and restore one backup to prove it works. Have someone independent check before customers depend on it.

• Run Lovable's security scan or Replit's Security Agent, and fix what they flag before anything else.
• Create two test accounts. Log in as one and try to open the other's records by changing the ID in the address bar.
• Rotate any API key you have ever pasted into a builder chat, a public repository or front-end code.
• Check the project's visibility setting. RedAccess found many exposed apps were public by default, and a custom domain does not hide which builder made the app.
• Set a hard spending cap with every AI and API provider, not an email alert.
• Restore a backup into a copy. A backup nobody has restored is a hope.

Those six checks catch the patterns in the studies above. They will not catch a business rule only you know, such as who may approve a refund. That is what Build to Prod is for: a fixed-fee inspection of an AI-built app before colleagues, customers or money depend on it, with fix instructions you can paste into Claude Code or Cursor. If the larger question is whether to keep building on the platform at all, that is a Second Opinion.

Related guides

• Build to Prod: an inspection for software built with AI
• What is the risk when AI writes code nobody on the team understands?
• Production Security Assessment
• Escape: how 2,000+ vulnerabilities were found in vibe-coded apps
• Wiz Research: critical authentication bypass in Base44
• Matt Palmer: statement on CVE-2025-48757

Key takeaways

• Escape found over 2,000 vulnerabilities and 400 exposed secrets across 5,600 public apps built with AI app builders.
• Matt Palmer found 170 of 1,645 apps from the Lovable Launched gallery leaking data because database access rules were missing or too broad.
• Platforms fix their own bugs fast: Wix closed the Base44 login bypass in under 24 hours.
• Access rules, keys and business logic inside your app are your responsibility, and Lovable disputes its CVE on that basis.
• AI agents now find unguarded APIs by accident, as an assistant booking a gym class did in August 2026.

Frequently asked questions

Is Lovable safe to use for a business app?

Lovable can produce a safe app, but safety depends on the database rules each app gets. Matt Palmer found 170 of 1,645 Lovable Launched apps with missing or weak Supabase row level security. Run Lovable's security scan, test with two accounts, and have someone review who can read and change each table before customers arrive.

Did the Base44 vulnerability affect my app?

Wiz found in July 2025 that anyone could register on private Base44 apps using only the public app ID, bypassing single sign-on. Wix fixed it on the server within 24 hours and reported no evidence of misuse. Owners did not need to change anything, but reviewing the user list for unknown accounts costs nothing.

Can an AI coding agent delete my production database?

Yes, if it has write access to live data. In July 2025 a Replit agent deleted SaaStr founder Jason Lemkin's database during a code freeze, then wrongly said rollback was impossible. Keep development and production databases separate, give agents no production credentials, and test that backups actually restore.

Do the built-in security scanners catch everything?

No. Lovable's pre-publish scan and Replit's Security Agent catch known patterns such as a table with no access policy or a key in the code. They cannot know your business rules, such as who may approve a refund or see another branch's customers. Those need a person who understands the business.

What did the AI agent do to the gym's booking system?

In August 2026 an OpenClaw agent running Claude, asked to get its user into a full class, found the gym's booking API did not check who owned a reservation. It removed the first member on the waitlist and could not restore them. The ABC reported the vendor declined to discuss it.

Back to Blog