Vulnerabilities & Fixes

Deep dives on the vulnerabilities that actually hit AI-built apps · exposed keys and secrets, XSS, CSRF, injection, CORS, missing headers · each with a concrete fix.

  • CVE-2025-48757 Explained: How to Check If Your Lovable App Is Affected · CVE-2025-48757 is a critical authorization bypass affecting Lovable apps where Row-Level Security (RLS) is missing. Attackers can skip frontend logins to query database tables directly. To fix it, you must enable RLS on all Supabase tables and enforce server-side session validation using supabase.auth.getUser() instead of relying on client-side state.
  • How to Fix Exposed API Keys in 5 Minutes · To fix exposed API keys, immediately revoke the key at the provider dashboard to stop exploitation. Audit usage logs for abuse, move the API call to a server-side proxy like an Edge Function, and store the new key as a secure environment variable without public prefixes to prevent future leaks.
  • Why Exposed API Keys in Frontend Code Are Dangerous · Exposed API keys in frontend JavaScript are public secrets. Because browsers must download your code to run it, any key in your React or Vue bundle is visible to bots and attackers. This leads to account takeovers and massive financial bills. The fix: rotate keys immediately and move them to a server-side proxy.
  • XSS Prevention Guide: Protect Your AI-Built App from Cross-Site Scripting · Prevent XSS in AI-built apps by avoiding dangerous sinks like dangerouslySetInnerHTML and innerHTML. Use DOMPurify for sanitization, prefer textContent for plain text, and implement a strict Content-Security-Policy (CSP). AI-generated code often bypasses framework protections, making manual security audits and automated scanning essential for safety.
  • CSRF Protection & Security Headers: The Missing Layer in AI-Built Apps · Security headers like CSP, HSTS, and X-Frame-Options are the missing defense layer in AI-built apps. While tools like Cursor and Lovable generate functional code, they rarely configure the HTTP headers needed to block XSS and clickjacking. Learn how to implement these headers and CSRF protection to secure your vibe-coded projects.
  • Code Injection Prevention: SQL Injection, eval(), and Command Injection in AI Apps · Prevent code injection by never mixing untrusted input with interpreters. Use parameterized queries or ORMs to block SQL injection, cast NoSQL inputs to strings to prevent operator injection, and replace eval() with safe parsers like mathjs. These vulnerabilities appear in 30% of AI-built apps scanned by SimplyScan.
  • AI Security Risks: Prompt Injection, LLM Abuse, and API Key Exposure · AI features introduce three critical risks: prompt injection, where user input overrides system instructions; LLM abuse, where unprotected endpoints lead to massive API costs; and API key exposure, where hardcoded secrets allow attackers to hijack your accounts. Defend your app with server-side keys, per-user rate limits, and role-separated prompts.
  • OWASP Top 10 for AI-Built Apps: What Vibe Coders Need to Know · AI-built apps are vulnerable to the OWASP Top 10 because AI models reproduce insecure patterns like frontend-only access control and string-concatenated SQL. To secure your app, you must enforce server-side RLS, use parameterized queries, and validate all inputs. SimplyScan's data shows 30% of AI apps have high-severity issues.
  • Environment Variables Security: Stop Leaking Secrets to Production · Environment variables only protect secrets when used correctly. Any variable prefixed VITE_, NEXT_PUBLIC_, or REACT_APP_ is embedded in your JavaScript bundle and readable by every visitor. Keep API keys, service role keys, and database URLs server-side without a public prefix and verify your bundle contains no secrets.
  • JWT Security: How to Read a Token and Catch the Red Flags · No, a JWT is not encrypted; it is signed. Anyone holding a token can decode the payload in seconds. Security depends on server-side verification: you must reject alg: none, pin your algorithm, check the exp claim, use strong secrets, and store tokens in httpOnly cookies to prevent theft.
  • Content Security Policy for Vibe-Coded Apps: A Practical CSP Guide · Content Security Policy (CSP) is a browser-enforced allowlist that blocks unauthorized scripts, providing the strongest defense against XSS. Most vibe-coded apps ship with no CSP or use 'unsafe-inline', which negates protection. This guide explains how to implement strict policies using nonces, hashes, and report-only mode to secure AI-built applications.
  • DNSSEC and CAA: Stop Attackers From Hijacking Your Domain · DNSSEC signs your DNS records so resolvers reject forged answers, stopping cache-poisoning redirects. CAA records restrict which certificate authorities may issue HTTPS certificates for your domain, blocking attacker-obtained certs. Both are free: enable DNSSEC at your DNS host, publish the DS record at your registrar, then add CAA records naming only the CAs you use.
  • security.txt: Give Researchers a Simple Way to Report Bugs (RFC 9116) · security.txt is a plain-text file at /.well-known/security.txt, defined by RFC 9116, that provides a standardized way for researchers to report vulnerabilities. It requires two fields: Contact and Expires. For AI-built apps, it is a vital safety net that ensures bugs are reported privately rather than disclosed publicly.
  • CORS Misconfigurations That Leak User Data (and How to Test For Them) · A CORS misconfiguration that reflects any request origin while allowing credentials lets malicious sites read your users' private API data. AI generators often create these permissive defaults to silence errors. To stay secure, use a hard-coded origin allow-list and test your API server-side with crafted Origin headers.
  • Is It Safe to Expose Your Supabase Anon Key? Yes · With One Condition · Yes, exposing your Supabase anon key is safe because it is designed to be public. However, this is only true if Row Level Security (RLS) is enabled on every table. Without RLS, the anon key allows anyone to read your entire database. Never expose the service_role key.
  • How to Find Exposed Secrets in Your Code Before They Ship · Exposed secrets hide in three predictable places: frontend bundles, git history, and misprefixed .env files. Grep your code and built output for known prefixes like sk_live_, AKIA, and ghp_, then use an automated secret scanner to catch high-entropy leaks. If you find one, rotate the key immediately to end the exposure.
  • Webhook Signature Verification: Stop Trusting Unsigned Payloads · Verify every webhook by computing the HMAC-SHA256 of the raw request body using your shared secret and comparing it to the provider's signature header with a timing-safe function. Add a five-minute timestamp tolerance and event-ID deduplication to prevent replay attacks. Without this, anyone can forge events to your endpoint.
  • DNS Records Explained: A, CNAME, MX, TXT, NS and CAA for App Builders · DNS records tell the internet where your app loads, where your email lands, and who may issue certificates for your domain. A and AAAA map names to addresses, CNAME aliases them, MX routes mail, TXT carries SPF, DKIM and DMARC, NS delegates control, and CAA restricts certificate issuance · audit all six regularly.
  • Broken Access Control Checklist · Find and Fix OWASP A01 · Broken access control (OWASP A01) occurs when an app fails to restrict users from accessing data or functions they do not own. To fix it, you must implement server-side ownership checks, enforce role-based access control (RBAC), and enable Row-Level Security (RLS). Never rely on the UI to hide buttons.
  • AI API Security · Protecting LLM-Powered Apps, Keys, and Endpoints · AI API security involves protecting LLM keys (OpenAI, Anthropic) and hardening the endpoints you build. To secure your app, keep keys server-side in a proxy, implement per-user rate limits to prevent "denial of wallet" attacks, and sanitize all model outputs to block XSS and prompt injection.
  • How to Remove Secrets from Environment Variables and Git History · To remove secrets from environment variables, you must rotate compromised credentials immediately and use tools like git filter-repo or BFG Repo-Cleaner to scrub them from Git history. Simply deleting the file is insufficient. Migrate to a dedicated secret manager to prevent plain-text exposure in .env files or system process lists.
  • Hapi.js Injection Prevention: Secure Your Backend Against Attacks · To prevent injection in Hapi.js, you must use Joi for strict input validation and employ parameterized queries for database interactions. By enforcing schemas on payloads and query parameters, Hapi.js blocks malicious data before it reaches your logic, effectively mitigating SQL, NoSQL, and command injection risks in Node.js backends.

Browse other categories: Platform Security Guides · Database & API Security · Security Checklists · Comparisons & Reviews · Speed & Performance · AI Coding Security · Security Fundamentals

All security guides