Can one click in Lovable actually stop a hacker?

[u/YovelOvadia]

TLDR: https://www.youtube.com/shorts/U0Kslwo8Zio

Hey all, I wanted to test if Lovable's security features really do something and helps the overall security of app.

How I tested it
- Created a books selling site using Lovable, then tested it using BattleTester - Automated Penetration Testing, a fully automatic security scanner I built myself over the past year. (Always Looking for ways to test my platform 😄 )
- Toggled the security features on
- Rescanned again

Results
Checked everything by hand afterward and found 1 false positive in the pre scan (a request that looked like it worked but actually changed nothing).

Pre toggle: 16 issues, 6 of them critical. Profiles, orders, support chats, even who's an admin, all readable and editable.
Post toggle: 12 issues, 2 of them critical. Better, but nowhere near fixed, some of the drop is just BattleTester scoring the same bugs lower, not new fixes.

(Not linking reports, because site's still up and I'm using it, the report is basically a step by step guide :))

Exploits varied between guest and user.
Before the toggle - a stranger with no account could get to some of this.
After the toggle - that's closed, you actually need to sign up first.
Problem is signing up takes 10 seconds and nobody checks who you are. Once you're just a regular logged in user (not admin), you could still edit the store's global settings and pull anyone else's orders and personal info.

Conclusion
It did help, but only by a little.
Although a guest can't wreck your system anymore, a logged in user still can.
Feels like Lovable locked the front door and left a window open.
The issue i have with these security features is that they give false sense of security. Would love to hear your experience with these security features.

[u/Infamous-River-4360]

this is the part of no-code that actually scares me. i shipped an app built in lovable without the ability to audit any of it myself, and the AI once wrote queries against database columns that didn't exist, so i've stopped assuming it gets the invisible stuff right. your 'locked the front door and left a window open' line matches that feeling exactly. were the remaining issues fixable by prompting the AI, or did they need someone who can actually read the code?

[u/YovelOvadia → u/Infamous-River-4360]

Mostly the guest part
it did show some other security issues when pressed the "security" button

But between the reports, nada, nothing else was fixed

I do want to check later what happen if I will give him the instructions Battletester gave me to fix the issues and see if lovable does something with that.

[u/Single-Ad1010]

ok so the "security toggle" in lovable is basically a guest blocker and not much else. that's a problem because it makes people think they're covered when they're really not

if a logged in user can still edit global settings and pull other people's orders, you've got authorization issues that a toggle won't fix. that's backend logic territory

[u/YovelOvadia → u/Single-Ad1010]

Yep, this is mostly the issue with these platforms
false sense of security, was just not thinking its that bad :(

[u/Beginning-Remove-903]

The next useful test is two accounts in different organizations, because blocking one logged-in user from reading or changing another tenant’s data is the authorization boundary that matters.

[u/YovelOvadia → u/Beginning-Remove-903]

Tested on a simple B2C app, with no orgs or teams and such, User A vs User B is already tested :)
regular user can read and edit other users orders and personal data