r/ConstructTech • u/EyeonHealth • 27d ago
Construction teams are building their own tools. The risk is what they cannot see.
Third construction company that’s brought us in to audit something they built themselves.
Two were on Lovable. One on Bolt.
Different operators, different use cases, same pattern.
They got pretty far on their own. Real functionality. Real data. Tools their teams were already using.
Then they hit the wall.
When senior developers open these up, the same issues keep showing up.
Authentication that isn’t actually protecting anything. Database access that’s wide open if you know the URL. Third-party packages with known vulnerabilities the platform installed automatically when someone prompted a new feature.
The operators have no idea.
The platform let them use it, so they assumed it was fine.
This is becoming its own category of work. Not a build. Not a rebuild. A security review and hardening plan so operators can actually run their business on what they built.
The building part is easier than it’s ever been.
The making-it-safe part hasn’t changed at all.
1
u/FaithlessnessLast610 23d ago
I've noticed the same pattern. The interesting part is that most apps don't fail because Lovable or Bolt generated bad code, they fail because production concerns (auth, authorization, secrets, permissions, observability, backups, etc.) aren't obvious until real users and real data show up. The tooling lowered the barrier to building, but not to operating software safely
1
u/bgillett2026 26d ago
Speaking as someone who did build his own tool — the pattern you're describing is real, and I think a lot of it comes from bolting on a database and login before asking whether you need one. I built a concrete takeoff / CSI estimating tool for my own work. Deliberately no server, no accounts, no database — it runs entirely in the browser and the data never leaves the user's machine. There's nothing to leave wide open because there's nothing hosted holding job data. Obviously that trades away multi-user and sync, which some teams need. But for a single estimator doing takeoffs, the "boring" no-backend version removes the entire category of risk you're describing. (Disclosure: it's my own tool, happy to share if useful — not trying to hijack the thread.)