8 Security Holes AI Coding Tools Leave

AI coding tools are astonishingly productive and remarkably consistent, including in how they leave your app exposed. Across Cursor, v0, Lovable, Replit, Bolt and Antigravity, the same eight holes show up again and again. Here's the list.

This article is for anyone who shipped an app with an AI coding tool and wants the short version of what to fix. Each item: what it is, why the tool leaves it, and the one-line fix. For the deeper treatment, see the pillar guide on securing a vibe-coded app.

1. Leaked API keys

A key gets pasted into a file, committed, and pushed, often to a public repo. Once it's in git history, deleting the line does nothing; the key is compromised. Fix: keep secrets in env vars and scan your repo for leaks. Rotate anything exposed.

2. Endpoints with no auth check

Server actions and API routes are functions on the public internet. AI tools wire the happy path and forget to ask who's calling, leaving mutations open to anyone. Fix: verify the session at the top of every action and route that touches user data.

3. Missing input validation

A handler that trusts whatever shape the body arrives in hands control of that shape to an attacker. Fix: validate every external input against a schema at the boundary.

4. Secrets in public env vars

Anything prefixed NEXT_PUBLIC_ / PUBLIC_ is bundled into what every visitor downloads. A service-role key there is game over. Fix: audit every public-prefixed variable; only truly public values qualify.

5. Permissive database policies

For Supabase apps, AI-generated Row-Level Security policies often allow far more than intended, sometimes a plain select against your users table. Fix: test each policy as an unauthenticated and as a wrong user, not just as yourself.

6. Unmetered AI and billing endpoints

An /api/chat route with no auth or rate limit is an open invitation to run up your LLM bill. Fix: require auth, add per-user rate limits, cap spend at the provider.

7. Secrets in the client bundle

Server functions that return whole env objects, or fold secrets into error messages, ship them straight to the browser. Fix: return only what the UI needs; keep errors generic.

8. No rate limiting

Without limits, login, signup and expensive routes are open to brute force and abuse. Fix: rate-limit anything sensitive or costly.

The pattern behind all eight

These aren't random bugs: they're what you get when a model optimises for code that runs rather than code that's safe, trained on public examples that skipped security too. The categories line up neatly with the OWASP Top 10; AI tooling just produces them faster. The gaps shift by tool: see the guides for Cursor, v0, Lovable, Replit, Bolt and Antigravity, but the eight categories don't.

Check yours in two minutes

Run a free key-leak scan on your public repo now, or book a Launch scan for a full review across all eight: we read the code and open pull requests with the fixes, in plain English.