Find the data leak in your AI-built app before a stranger does
AI builders ship working apps fast, and they often ship the database wide open: tables without Row Level Security, secret keys in the browser bundle, storage buckets anyone can list. Launch Lock checks your live app the way an attacker would, using only what a visitor can see, then gives you a ranked list of fixes written as SQL and prompts you can paste straight back into your builder.
- Every table tested for anonymous read and write with your public key, plus storage buckets, edge functions and auth settings.
- Fixes come as ready-to-run Row Level Security policies and builder prompts, ranked by what an attacker could actually reach.
- One price per app, paid once. We re-test after you apply the fixes, at no extra charge.
CVE-2025-48757 records insufficient Row Level Security in Lovable-generated apps that let unauthenticated users read or write arbitrary tables; it is rated critical (CVSS 9.3) and disputed by Lovable.
Source: cvemon.intruder.ioScanning 1,645 apps from Lovable's showcase, a researcher found 170 apps and 303 endpoints readable or writable with only the public anon key.
Source: superblocks.comOne agency lists a fixed one-time security audit for Lovable apps at $1,000, taking about 5 business days.
Source: rapidevelopers.comAI builders write the app; nobody checks who else can read the database
Apps built with Lovable, Bolt, v0 and similar tools usually talk to Supabase or Firebase directly from the browser. That is safe only if the database rules are right: Row Level Security on every table, policies that limit each user to their own rows, and no secret keys shipped to the client. The builder produces a working app either way, so a missing policy looks exactly like a finished feature.
This is not hypothetical. A researcher who scanned 1,645 apps from Lovable's public showcase found 170 of them, about one in ten, with tables that anyone could read or write using only the public key. The finding was recorded as CVE-2025-48757 with a critical score, and the lesson applies to every AI builder: the platform generates the code, and the owner is responsible for the data.
Professional penetration tests are priced for funded companies, and freelance audits vary widely in scope. Launch Lock is a fixed-scope check for the specific mistakes AI-built apps make, at a price that fits a side project about to take its first payment, with fixes you can apply without hiring a developer.
Without it
- Your builder's own security scan: Builders are adding automated checks; Lovable now offers built-in penetration tests. Run them. An independent check…
- Freelance audits on Fiverr, Upwork or Contra: Prices run from about $50 to several thousand dollars, and scope varies from a quick code skim to a full test. Good…
- Security firms and penetration testers: The right choice for regulated products or funded companies that need a formal pentest, typically priced in the…
With Launch Lock
- Every table tested for anonymous read and write with your public key, plus storage buckets, edge functions and auth settings.
- Fixes come as ready-to-run Row Level Security policies and builder prompts, ranked by what an attacker could actually reach.
- One price per app, paid once. We re-test after you apply the fixes, at no extra charge.
- Row Level Security check
- Secrets in the bundle
How it works
- 1
Tell us about the app
Send the live URL, the builder and backend you used, and two test accounts. You confirm in writing that you own the app; we never test anything without that.
- 2
We test it from the outside
Using only what a browser receives, we try anonymous and cross-user reads and writes on every table, list storage buckets, call edge functions, and check auth, password and email settings. Write tests use throwaway rows we delete.
- 3
You get ranked fixes
A report within 2 business days: each finding with what an attacker could see, a severity, and the fix as SQL policies, rule changes or a prompt for your builder.
- 4
We re-test
Apply the fixes, tell us, and we run the same checks again and confirm each finding is closed. The final report is yours to show customers or investors.
Features
Row Level Security check
Every Supabase table tested for anonymous and cross-user select, insert, update and delete, including tables the app does not use any more. Firebase apps get the same test against Firestore and Storage rules.
Secrets in the bundle
The JavaScript your users download is scanned for service-role keys, payment and AI provider keys, webhook secrets and admin endpoints that should never leave the server.
Storage and file exposure
Public buckets listed, signed-URL lifetimes checked, and uploaded files tested for access by other users, which is where invoices and ID photos usually leak.
Auth and account settings
Email confirmation, password rules, magic-link and OAuth redirect settings, rate limits on sign-up and login, and whether a user can change their own role.
Edge functions and APIs
Server functions called without a session or with another user's token, missing input checks on functions that write data, and CORS that allows any site.
Fixes you can paste
Ready-to-run RLS policies, Firebase rule snippets and plain-language prompts for Lovable, Bolt or Cursor, ordered by risk so the first hour of work closes the worst gaps.
Re-test and certificate
A second run after you fix things, and a dated summary stating what was tested and that no open critical findings remained.
A look inside
What you get: the working view and the delivery report.
Who it's for
Founders about to launch or take payments
The app works and users are coming. Check that one user cannot read another user's data before it becomes a support ticket or a breach notice.
Freelancers and agencies shipping client apps
Add an independent check to every handover, so the client gets a report and you are not the one explaining a leak six months later.
Non-technical teams with internal tools
HR, operations or sales tools built in an afternoon that now hold customer or employee data, and nobody has reviewed who can see it.
Anyone selling to bigger customers
A buyer's security questionnaire asks how data is protected. A dated audit with closed findings is a much easier answer.
Works with
- Supabase (Postgres RLS, Storage, Edge Functions, Auth)
- Firebase (Firestore and Storage rules, Auth)
- Lovable, Bolt, v0, Replit and Cursor projects
- Next.js, React and Vite front ends
- Stripe and Lemon Squeezy integrations
- GitHub repository review on the Audit + Fix plan
Pricing
One-time price per app, paid once after we confirm the scope. No subscription. A re-test after your fixes is included in every plan. Founding customer pricing applies to early-access orders.
Quick check
$29 one-time
A side project or MVP before its first real users
- Anonymous read and write test on every table
- Secrets scan of the browser bundle
- Public storage bucket check
- Ranked findings with copy-paste fixes
- One re-test
Full audit
$129 one-time
Apps with logins, payments or personal data
- Everything in Quick check
- Cross-user tests with your two test accounts
- Edge functions, API and CORS checks
- Auth, role and rate-limit review
- Firebase rules if you use Firebase
- Re-test and dated summary report
Audit + fixes
$349 one-time
When you want the gaps closed for you
- Everything in Full audit
- We write and apply the RLS policies and rules
- Pull requests on your GitHub repository
- Key rotation guidance for anything exposed
- Second re-test after deployment
- 30-minute review call
Compared with the alternatives
- Your builder's own security scan
- Builders are adding automated checks; Lovable now offers built-in penetration tests. Run them. An independent check tests the live app across tables and functions the builder's scan may not cover, and gives you a report from someone other than the vendor.
- Freelance audits on Fiverr, Upwork or Contra
- Prices run from about $50 to several thousand dollars, and scope varies from a quick code skim to a full test. Good options exist; compare exactly what is tested before you pay.
- Security firms and penetration testers
- The right choice for regulated products or funded companies that need a formal pentest, typically priced in the thousands. More than most early AI-built apps need on day one.
- Checking it yourself
- Free: Supabase shows which tables have RLS disabled, and its security advisor flags common problems. Worth doing first. The harder part is testing what another logged-in user can reach, which is where Launch Lock spends most of its time.
What changed
- CVE-2025-48757 records insufficient Row Level Security in Lovable-generated apps that let unauthenticated users read or write arbitrary tables; it is rated critical (CVSS 9.3) and disputed by Lovable. Source: cvemon.intruder.io
- Scanning 1,645 apps from Lovable's showcase, a researcher found 170 apps and 303 endpoints readable or writable with only the public anon key. Source: superblocks.com
- One agency lists a fixed one-time security audit for Lovable apps at $1,000, taking about 5 business days. Source: rapidevelopers.com
From request to a closed report
We confirm scope and authorization within one business day and deliver findings within 2 business days after that.
- Day 1: Request the service, send the URL and builder details, and sign the one-page authorization.
- Day 2: Testing runs; any critical finding is reported to you the same day.
- Day 3: Ranked report with fixes delivered; you or we apply them.
- Day 4–7: Re-test, confirmation of closed findings and the dated summary report.
Security and data
- We test only apps whose owners have authorized it in writing, within the agreed scope and time window.
- Test accounts and any credentials you share are stored encrypted and deleted when the job closes.
- Findings are shared only with the contacts you name; we never publish or disclose them to anyone else.
- Copies of data we could read during testing are not kept: the report shows table and column names and row counts, never your users' records.
- All job notes are deleted 30 days after delivery unless you ask us to keep them for your records.
Questions
Is my Lovable or Bolt app secure by default?
Not necessarily. The builder generates working code, but whether each table has Row Level Security and correct policies depends on how the app was prompted and changed over time. CVE-2025-48757 showed about one in ten scanned showcase apps exposed data through missing RLS.
Do you need access to our code or database?
Not for the Quick check or Full audit: we test the live app with only what a browser receives, plus two test accounts you create. The Audit + fixes plan uses read access to your GitHub repository and a time-limited database role you can revoke.
Will testing damage our data?
No. Read tests do not change anything. Write tests insert clearly labelled throwaway rows and delete them, and we never run destructive or high-volume tests against production. We can test a staging copy if you prefer.
Is this legal? Do you test other people's apps?
We only test apps whose owner has asked us to, in writing, and only within the scope agreed. We do not scan apps we have not been hired to check.
What happens if you find a key that was exposed?
We tell you the same day, without waiting for the report, and explain how to rotate it in the provider's dashboard. Treat any exposed secret as compromised even after it is removed from the code.
Is this a full penetration test or a compliance certification?
No. It is a fixed-scope check of the issues AI-built apps most often have: database access rules, exposed secrets, storage, auth and server functions. It does not certify compliance with SOC 2, ISO 27001, HIPAA or GDPR.
How quickly do we get results?
Within 2 business days of receiving the URL and test accounts, and the same day for any critical finding. The re-test is usually done within one business day of your request.
Ready when you are
Tell us about your setup. We confirm by email and get you running within 2 business days.
Request service