# Security for Lovable, Bolt and Cursor Apps

Apps built with Lovable, Bolt, Cursor or Replit can ship with open database rules or exposed keys. AgentProof finds and fixes them.

AI coding tools can build a working app in a day. They can also leave the database open or a secret key in the browser. AgentProof finds these problems in your app and fixes them in your code.

## Apps from Lovable, Bolt, Cursor or Replit are checked for open data.

- **SUPABASE** Is row level security on for every table, so your public key cannot read every row?
- **FIREBASE** Do your security rules let anyone read or write the whole database?
- **SECRET KEYS** Is a Stripe secret key, model provider key or Supabase service role key in the code sent to the browser?
- **HIDDEN PAGES** Are admin pages only hidden from the menu, but still open to anyone who types the address?
- **SERVER CHECKS** Does the server check who the user is, or does only the browser check?
- **SIGN UP** Can anyone sign up and get access that should be invite-only?

The public key in your app is meant to be public. **Your database rules are what keep the data private.**

## An example: a Supabase table with row level security turned off.

Example finding: Anyone with the public key can read every user's profile

```
REQUEST
GET /rest/v1/profiles?select=*
Public key, not signed in

RESPONSE
200 OK
Every user's email and phone number

FIX
+ alter table profiles enable row level security;
+ create policy "Read own profile" on profiles
+   for select using (auth.uid() = id);

RETEST
GET /rest/v1/profiles?select=*
200 OK, 0 rows. Fixed.
```

The fix is a database migration in your repository. **After it, each user can read only their own profile.**

## The Attack Agent tests your live app, not just the code it came from.

- **READING THE CODE:** Misses rules set in your database dashboard. Guesses what the live app does.
- **AGENTPROOF:** **Sends requests to your live app** and records what it actually sends back.

## Answers for founders who build with AI coding tools.

- **Is the Supabase anon key a secret?** No. It is meant to be in your app, and row level security decides what it can read. The service role key is the secret one. It must never reach the browser.
- **Will a fix break my app?** You choose how fixes ship. With pull requests, you review every change before it merges, and every fix is tested again with the original attack.
- **How often should my app be tested?** If you ship new features every day, daily checks test each day's changes. Monthly checks fit an app that changes less often.

## Monthly checks for one app cost $199 a month.

Both agents are included. **Weekly checks cost $399** and daily checks cost $999 a month.

- [See plans](/pricing/)
- [See how fixes work](/defense/)

## AgentProof also tests these kinds of apps.

- [SaaS](/solutions/saas/): Checks that each customer account can reach only its own data, roles and billing.
- [AI products](/solutions/ai/): Checks chats, shared links, model keys, usage limits and the tools your assistant can use.
- [Fintech](/solutions/fintech/): Checks accounts, transfers, amounts and approvals in apps that move money.
- [Health tech](/solutions/health-tech/): Checks that patients and staff see only the records they are allowed to see.
- [Marketplaces and stores](/solutions/marketplaces/): Checks prices, orders, payouts and the line between buyers and sellers.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.