What we find when we point the scanner at apps built with Cursor, Lovable, Replit, Bolt, v0 — plus the occasional opinion on why it keeps happening.
We found a live Anthropic + OpenAI + Google key trio in the same JS bundle. Here's what it looked like, how we found it, and what happens next.
One setting. Disabled by default. Exposes every user's data. Repeated across hundreds of apps. Here's why.
Replit's quick-deploy is great. It also makes it really easy to ship your API keys to the internet.
We scanned ~50 published Lovable apps. About 1 in 5 of the Supabase-backed ones had at least one table readable by anyone. Here's the pattern.
No marketing fluff — a direct walkthrough of every module we run.
After months of scanning our own infrastructure and finding one hole too many, we're opening Security Scanner to everyone.