Is your AI-generated app (Lovable, Bolt, Cursor…) ready for production?

Lovable, Bolt, v0 and Cursor let you ship a working app in a few days. That's real progress: you can test an idea with real users for a fraction of what it used to cost. We use AI to build software ourselves, every day.

But “it works on screen” doesn't mean “ready for production.” AI produces what you ask for. It doesn't think on its own about access rights, backups or GDPR. Problems often show up once real data is online.

What public research and incidents show

A few documented facts to set the scene.

• In March 2025, a researcher analyzed 1,645 apps built with Lovable. In 170 of them (about 10%), tables in the Supabase database could be read, and sometimes modified, without authentication, because Row Level Security rules were missing. Exposed data included emails, transactions and API keys. The flaw is tracked as CVE-2025-48757; Lovable disputes it, pointing out that each customer is responsible for protecting their app's data.
• Security vendor Escape scanned more than 5,600 public apps built with this kind of tool (Lovable, Bolt, Base44…). The result: over 2,000 vulnerabilities, over 400 exposed secrets (API keys, tokens) and 175 cases of exposed personal data, including medical records.
• In its March 2026 update, Veracode reports that only 55% of AI code-generation tasks produce secure code, a rate that has barely moved since 2025 despite newer models.
• In July 2025, Replit's AI agent deleted a user's production database during a code freeze, despite explicit instructions. The incident shows what can happen when test and production aren't separated.

The gaps we find most often

When we look at the code of an AI-generated app, the same issues come up almost every time.

• Authentication and authorization: login works, but nothing stops a logged-in user from reading someone else's data. With Supabase, tables without Row Level Security can be read using the public key that sits in the browser.
• Exposed API keys: an OpenAI, Stripe or email-service key placed in browser-side code can be picked up by anyone, and used at your expense.
• No input validation: the form checks fields on screen, but the server accepts anything.
• No tests: every new request to the AI can break a feature that used to work, without anyone noticing.
• No tested backups, no monitoring: you find out about the outage or the data loss from a customer.
• GDPR forgotten: no privacy policy, data hosted outside Europe without anyone knowing, no processing agreements with sub-processors, no deletion procedure.
• Runaway costs: unlimited AI calls, requests stuck in loops, files never cleaned up. The cloud bill grows with success, or with abuse.

A checklist before you open to real users

You can check many of these points yourself. Every “no” is worth fixing before you import real data.

• Every table that holds data has access rules, tested with two different accounts.
• No secret key appears in the code sent to the browser or in the Git repository.
• The server validates all incoming data, not just the form.
• Critical journeys (sign-up, payment, data access) are covered by automated tests.
• Automatic backups exist, and a restore has been tried at least once.
• Errors and outages trigger an alert.
• Test and production environments are separate, and the AI has no rights on production.
• Hosting is in Europe, or transfers outside the EU are properly covered, and sub-processors are listed.
• Spending caps are set with your AI and cloud providers.

Fix or rebuild?

There's no single answer. Often, an AI-generated app can be fixed: add the access rules, move secrets to the server, write the missing tests, set up backups and monitoring.

A rebuild makes sense when the data model is wrong from the start (for example, several clients' data mixed together without reliable separation), when the code has become too inconsistent to change without breaking something else, or when the project must meet strict requirements, in healthcare or finance for instance, that the current base can't support. Even then, the prototype isn't wasted: it validated the idea and the user journeys, which saves a lot of time.

That's what our AI app audit is for, at €900 excl. VAT: we review the code, security and data, and you get a clear, prioritized report. You then decide whether to fix it yourself, have us fix it at a fixed price, or rebuild. To find out whether an audit makes sense for you, the 30-minute diagnostic is free.

Sources

• NVD (NIST) — CVE-2025-48757: nvd.nist.gov/vuln/detail/CVE-2025-48757
• Matt Palmer — Statement on CVE-2025-48757: mattpalmer.io/posts/statement-on-CVE-2025-48757
• Escape — Research on 5,600+ AI-generated apps: escape.tech/research
• Veracode — Spring 2026 GenAI Code Security Update: veracode.com/blog/spring-2026-genai-code-security
• Supabase — Row Level Security documentation: supabase.com/docs/guides/database/postgres/row-level-security
• Fortune — Replit agent deletes a production database (July 2025): fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure