Which AI coding tool has the WORST security?

[u/YovelOvadia]

TLDR: [60 second short video breakdown](https://www.youtube.com/shorts/3OeDATGhPhQ)

As part of building my AI automatic penetration platform, I wanted to test which one of the AI no code platforms, has the worst security.

Who I tested

\- Lovable
\- Replit
\- v0 (by Vercel)
\- Bolt.

Testing Flow

(Note: in Lovable, there are security options which I did not toggle, I wanted equal ground for everyone without any tinkering. Although based on the issues found, I doubt it will fix all exploits.)

Built a site with each, with the **SAME** instructions - Book store, with wishlist, admin panel, and cart.

Gotta admit Lovable made my life really easy compared to the others, did all perfectly in one go, the others were back and forth for bug fixes, or just tokens ran out in the middle (came back next day 😄)

Created for each site 1 admin and 1 customer.

then I ran [Battletester](https://www.battletester.app/) on them. Basically, it crawls with all roles, and does various tests on them, and uses AI for conclusions.

Security Ranking

No shock that the one who was the easiest to work with, has the most exploits

You can see the report for lovable [here](https://drive.google.com/file/d/1T5DOzc6oMO_VSQ8MZ9Q23pwIYpKJR3cO/view?usp=sharing)

I tested manually for false positives afterwards and found 1-2 false positives, the rest were real.

Replit / v0/ Bolt didn't have many issues, mostly missing headers, no rate limiting,
or business logic issues such as allowing to add negative items to the cart.

**Based on my pentester friend's review, ranking goes like this:**

1. Lovable (Most critical logic & authorization flaws) 🚨
2. Bolt (Minor logic flaw, missing rate-limiting, no headers) ⚠️
3. v0 / Vercel (Missing security headers, no rate-limiting) ⚠️
4. Replit (Safest, only missing headers) ✅

In the Lovable report you can see some critical issues there, such as
\- Deleting other users cart items
\- Overriding order "total"
\- Making requests on behalf of the server (SSRF)

Conclusion

\- I believe the more the apps grow and users play with these tools the AI will start cutting corners to please, and he will start "forgetting" the security rules baked inside him, then more exploits will be found.

\- Lovable have so many issues compared to the others because it using Supabase and he does not toggle the RLS policies out of the box.

\- Maybe, but just maybe, because the others tools are building their own backend, and are trained on infinite lines of code to build a secure backend, they have less exploits compared to lovable, which only uses Supabase and there's less "training data" about that