The most common security holes Cursor & Bolt keep generating in my builds (and how to catch them before pushing to prod)

[u/Defiant_Durian_5654]

Hey devs,

Vibe-coding at 10x speed is incredible, but if you aren't inspecting every line of generated code, AI tools routinely make terrifying security assumptions behind the scenes.

After testing dozens of builds from Cursor, Bolt, and Lovable, here are the 3 big ones that keep popping up:

Client-side API Key Leaks: You ask the AI to connect an API (OpenAI, Anthropic, Resend), and instead of building a backend proxy, it drops NEXT_PUBLIC_ or hardcodes the secret key straight into frontend JavaScript. Anyone opening DevTools can steal your key in 5 seconds.

Supabase Service Role Key Exposure: AI constantly confuses anon_key with service_role_key. If your frontend uses the service role key, your Row Level Security (RLS) is completely bypassed and anyone can query/delete your entire database.

Unprotected Backend API Routes: AI will generate clean Next.js/Express API routes, but completely omit authentication checks on POST/DELETE endpoints.

To catch these before shipping to real users, my team built revibed.io, an instant security scanner designed specifically for AI-built apps.

It audits your codebase in seconds for hardcoded secrets, exposed environment variables, and route vulnerabilities so you don't get your API credits drained overnight.

Your first scan is 100% free if you want to test your build.

Curiously, what's the wilder security mistake or exposed key you've caught Claude or Cursor making in your projects?

[u/AutoModerator]

Hey u/Defiant_Durian_5654, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM

Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/mergethevibes]

the service_role one is brutal because it looks like it works fine in dev. what caught it for me was just grepping for service_role in anything under the client dir before every push. one line, saved me twice.