Security advisories
for vibe-coded apps
Sourced, plain-English advisories for Lovable, Bolt, v0, Replit, Base44 and Cursor apps: what broke, how to check yours, and the fix.
Check my app→Supabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeCVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedBase44: private apps open to anyone with the app_id (Wiz)AI agent deleted a production database during a code freeze (Replit)CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSCVE-2025-29927: Next.js middleware authorization bypassProtecting routes only in middleware“Rules File Backdoor”: hidden Unicode instructions in AI rules filesAuthentication logic living entirely in the browserSlopsquatting: AI suggests packages that don’t existSupabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeCVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedBase44: private apps open to anyone with the app_id (Wiz)AI agent deleted a production database during a code freeze (Replit)CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSCVE-2025-29927: Next.js middleware authorization bypassProtecting routes only in middleware“Rules File Backdoor”: hidden Unicode instructions in AI rules filesAuthentication logic living entirely in the browserSlopsquatting: AI suggests packages that don’t exist
What we track
Every known hole, sourced and fixable
Each advisory cites a CVE, vendor advisory or published research, and gives you a check you can run in minutes plus the code to fix it.
01.5Critical advisoriesData exposed or full takeover possible.
02.13Advisories total7 high · 1 medium · 4 with CVEs.
03.6Builders trackedLovable, Bolt, v0, Replit, Base44, Cursor.
Browse advisories
13 advisories
01.critical Supabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. LovableBoltv0+3 2026-08 02.critical Supabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. LovableBoltv0+3 2026-08 03.critical Base44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 04.critical CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable 2025-05 05.critical CVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. v0BoltCursor+1 2025-03 06.high Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. LovableBoltv0+3 2026-08 07.high CVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 08.high CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor 2025-08 09.high AI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. ReplitCursor 2025-07 10.high “Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor 2025-03 11.high Authentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. LovableBase44Bolt+3 2025 12.high Slopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. CursorLovableBolt+3 2025 13.medium Protecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. v0BoltCursor+1 2025-03