I tested security across 4 AI app builders (Lovable, Bolt, v0, Replit)

I've been building an automated security testing platform, and wanted a real test case, so I built the same app four times with four different AI builders and scanned each one.

Who I tested

• Lovable
• Replit
• v0 (by Vercel)
• Bolt

Testing flow

Built a site with each, same instructions every time: book store, wishlist, admin panel, cart. Note: Lovable has a security toggle I deliberately left off for this test - wanted equal ground across all four without any manual tinkering. One admin account and one customer account per site.

Gotta admit, Lovable gave me the easiest life to work with, all in one go and the tokens did not ran out (compared to the others...)

Then ran BattleTester against each. it craws each site with admin/user/guest and after finding all relevant info, start running tests per category (access control, business logic, headers, etc.)

Results

Remember me saying Lovable was the easiest to work with?

Well... Lovable came out worst by a wide margin.

Lovable's full report here: 13 findings - 4 critical, 5 high, 3 medium, 1 low. The four critical ones:

• An IDOR letting a standard user delete another user's cart items
• A standard user modifying order status (should be admin-only)
• Two separate order-total bugs: arbitrary total accepted on order creation, and negative/zero totals both accepted

I checked every finding by hand afterward with the help of a friend. The report also flagged the Supabase backend as fully queryable with just the public anon key, but that one didn't hold up under manual testing (false positive). 1-2 false positives total, the rest held up.

Replit / v0 / Bolt had far fewer issues, mostly missing headers, no rate limiting, and smaller business logic gaps like negative cart quantities.

Rough ranking, by finding count and severity:

1. Lovable - most critical logic and authorization flaws
2. Bolt - minor logic flaw, missing rate limiting, no headers
3. v0 - missing security headers, no rate limiting
4. Replit - safest of the four, only missing headers

Why Lovable specifically

Worth being precise here since it's not one root cause. Of the 13 findings, only 3 are actually access-control/RLS issues: the cart deletion, the order status change, and an unauthorized book edit. The other 10 - the order total bugs, a review-without-purchase bug, an SSRF via an image URL parameter, missing rate limiting, and the header issues - have nothing to do with RLS and I doubt would be fixed by turning security features on.

My best guess: Lovable's speed comes from leaning almost entirely on Supabase with minimal custom backend code, so RLS not being on by default accounts for a real chunk of it. But the rest is just less input validation across the board, not a single misconfiguration.