SHIPGRADE
← ALL NOTES
2026-08-12SECURITYAI-CODEGEN

What we found auditing 30 AI-built apps

Written by our solutions architect, who read every one of the 30 repos.

Over the past year we've audited 30 apps built primarily with Lovable, Bolt, v0, Cursor, or Replit. Every one of them worked. Every founder had validated something real. And 27 of the 30 shared the same top four findings, which is the most encouraging statistic in this post: consistent problems have rehearsed fixes.

Before the numbers, the framing that matters: none of this means the prototypes were mistakes. They did their job. These findings are what “the job” doesn't include.

The numbers

Secrets committed to the repo24 / 30
Endpoints missing auth checks21 / 30
Zero automated tests27 / 30
No backups beyond the host default26 / 30

The pattern behind them

Codegen tools optimize for the demo, because that's what you can see and iterate on. The result is code that looks complete and is structurally missing its production half. Here's a route we see, in some form, in most audits:

// generated route — looks fine, isn't
app.post('/api/orders', async (req, res) => {
  const order = await db.orders.create(req.body);
  res.json(order);           // no auth, no validation,
});                          // no idempotency, no logging
FINDING · CRITICAL

Any logged-in user, or in some cases anyone at all, can create orders with arbitrary fields.

THE FIX · ~2 HOURS

Auth middleware on the router, a validation schema on the body, and an ownership check before the write. Rehearsed fix; we've shipped it 24 times.

What this means for your app

If you built with these tools, your app almost certainly has some of the findings above. That's not a verdict on you or the tools; it's the current shape of the gap between prototype and product. The gap is finite, well mapped, and in our experience closes in about four weeks.

NEXT STEP
Find out what an audit of your app would say.
Get the free audit48-hour turnaround · repo stays private · no sales calls required
GRADED REPORT · EVERY FINDING PAIRED WITH ITS FIX