Security audits for apps built with AI: Lovable, Bolt, v0, Cursor and Copilot

If you built your app with a generator or a copilot, it most likely works. Who can read your data is another matter. That is exactly what we review, whether or not you have an in-house technical team.

Scope your project · Audit my app

Rather talk it through? Call us at +34 960 730 013

Why does AI-generated code introduce security risks?

LLMs generate plausible code, not secure code. The reference academic study on GitHub Copilot ("Asleep at the Keyboard?", NYU, IEEE S&P 2022) generated 1,689 programs across 89 scenarios tied to the CWE Top 25 and found roughly 40% of them to be vulnerable. Models reproduce insecure patterns present in their training data, don't understand the security context of your specific application, and can't reason about the business impact of a vulnerability. "Vibe coding" — developing without understanding the code the AI generates — amplifies these risks exponentially.

What we audit

  • Exposed database: Supabase or Firebase keys in the browser and Row Level Security left disabled
  • Cross-user authorization: making sure nobody can read or modify another account's records
  • Secrets and endpoints leaked in the front-end bundle (Stripe, email, third-party APIs)
  • Open storage rules on file buckets
  • SQL, NoSQL, LDAP and command injections generated by LLMs
  • Insecure handling of secrets and hardcoded credentials
  • Weak authentication and authorization (broken auth, IDOR, privilege escalation)
  • Insufficient input validation and XSS in generated code
  • Insecure dependencies suggested by AI (supply chain risk)
  • Insecure cryptography patterns (obsolete algorithms, reused IVs)
  • Sensitive data exposure in logs, errors and API responses
  • Race conditions and concurrency issues in async code
  • OWASP Top 10 2021 + OWASP ASVS as the evaluation criteria

Audit process

  1. Code origin analysis: We identify which parts of the codebase were AI-generated and which tools were used (Copilot, Cursor, ChatGPT, etc.).
  2. AI-augmented SAST: Automated static analysis with specialized tools, followed by manual review by experts with context on typical LLM vulnerabilities.
  3. Dependency review: Analysis of every AI-suggested dependency: active CVEs, maintenance status, licenses and supply chain risks.
  4. Dynamic testing: Validation of the vulnerabilities found in the development or staging environment.
  5. Report and training: A findings report plus a training session for the team on the risks of AI-generated code and best practices.

Deliverables

  • Code security report with findings classified by OWASP ASVS
  • List of insecure dependencies with recommended alternatives
  • Secure prompting guide for the LLMs your team uses
  • Training session: vibe coding risks and how to mitigate them
  • Security checklist to integrate into your code review process

Use cases

  • A customer or supplier has asked you for written security assurances
  • You are about to launch the app and nobody has ever reviewed its security
  • You built the product without an in-house technical team and don't know what was left open
  • Startups that built their MVP with GitHub Copilot or Cursor
  • Teams using ChatGPT or Claude to generate production code
  • Companies that outsourced development and want to audit the delivered code
  • CTOs who want to establish a secure AI-assisted development process
  • Startups before launch or fundraising that need security guarantees

Frequently asked questions

Is AI-generated code less secure than code written by humans?

Not necessarily, but it introduces different risks. LLMs are very good at reproducing known patterns, but that includes insecure patterns too. The biggest risk is "vibe coding": the developer doesn't understand the code and can't identify the security issues.

Do you need access to the full repository?

Yes, a complete analysis requires read access to the source code. We work with GitHub, GitLab and Bitbucket, and we sign an NDA before any access.

Can you audit code generated with Cursor, Devin or other AI tools?

Yes. The specific AI generation tool matters less than the vulnerability pattern in the resulting code. We evaluate the code regardless of which tool generated it.

I have no developer or technical team. Can you still audit it?

Yes. We need the application URL and, where it exists, read access to the builder project or the repository. Many of the failures typical of these applications — a database reachable from the browser, keys sitting in the front-end code, other accounts' data on display — are detectable from the outside, without touching the code. The report is written in plain language and, if needed, we walk whoever applies the fixes through it directly.

Do you audit apps built with Lovable, Bolt or v0, or only Copilot code?

Both, though the work differs. With a copilot such as Copilot or Cursor there is a repository and the audit resembles a classic code review. With an app builder such as Lovable, Bolt, v0 or Replit, the flaw is rarely in a specific line: it sits in the configuration the builder left open by default, especially in the data layer and in permissions between users. There we assess the deployed application, not just the code.

Related resources

Sources

Ready to protect your business?

Answer the scoping form at your own pace and we'll use it to prepare your proposal. If you'd rather talk first, book a free 30-minute call.

Scope your project · Audit my app