AI coding tools/Lovable
It depends almost entirely on whether the database access rules were configured, because that is where the real enforcement lives. Lovable generates a working application with a hosted backend, and the client holds a key that is safe only when the database restricts what it can do. Until then the app looks correct while being open.
Lovable is an AI app builder that generates full-stack applications with a hosted backend. Lovable generates both interface and backend wiring, so the database access rules it produces are doing real security work from the first deployment.
These are patterns we look for in code produced this way — not flaws in Lovable itself. Each names the check that finds it.
A hosted backend is secured by rules that constrain what each caller may read and write, table by table. A generated app connects and works perfectly before any of those rules exist, so nothing in the running application signals their absence: the interface behaves identically whether the database is locked down or completely open to anyone holding the public key.
Detected by: Unvalidated request input
The key embedded in the frontend is public by design, and safe only in combination with restrictive rules behind it. Where a generated app reaches for a more privileged key because a feature would not otherwise work, that elevated privilege is shipped to every visitor along with the JavaScript, and it can be read straight out of the bundle.
Detected by: Hardcoded API key or secret
The fastest way past a rule that blocks a feature is a rule that allows everything, added during development and rarely revisited. A permissive policy is indistinguishable from a correct one at runtime until someone tests it adversarially.
Detected by: Unvalidated request input
Applications that display user-supplied text — profiles, listings, messages, reviews — commonly render it straight into the page because that is the shortest path to a working feature. Without escaping, one user's input becomes script that executes in another user's authenticated session, which is a full account compromise rather than a display bug.
Detected by: innerHTML assignment
Every check named above runs automatically. Free on public repositories, no signup, results in under three minutes — with the file and line for each finding.
It generates a working application, which is not the same as a secured one. The controls that matter — database access rules — need to express your intended business logic, and no generator can infer that from a prompt describing the feature.
Database access rules. They are the real enforcement boundary, they are invisible from the interface, and an app with none behaves exactly like an app with correct ones right up until someone queries it directly with the public key.
Yes, once the access rules are written and tested and no privileged credential reaches the browser. Those are the two findings that separate a demo from something that can safely hold other people's data.