AI Website Security & Code Audit

You built it with AI. Does it actually hold up?

An independent website security audit for sites built with Lovable, v0, Bolt, Cursor, Replit, ChatGPT or Claude — covering the security holes, broken dependencies, and missing fundamentals that only surface once real users arrive.

Starting at $1,000 one-time
First response Within 48 hours
Scope Fixed, agreed upfront

AI writes confident code. Confident is not the same as secure.

Building a site with an LLM genuinely works, and it has put shipping within reach of people who could never have shipped before. That is a real shift, and we are not here to talk you out of it.

The failure mode is specific: the model optimises for code that runs, and a site that runs is not the same as a site that is secure, fast, findable, or maintainable. Nothing in the process flags an exposed API key or a form that writes to your database without validation, because the page still loads perfectly.

This is why website security questions about AI builders keep surfacing — searches for Lovable app security, v0 security, and whether vibe coding is safe have climbed steadily as more generated apps reach production. The concern is well founded, and it is answerable: the code exists, it can be read, and the common failure patterns are known.

So the problems stay invisible until the wrong person finds them. We look at what your AI actually built, with the adversarial eye a model applied to its own output cannot provide.

Sound familiar?
  • You cannot fully explain what portions of your own codebase do.
  • Supabase or Firebase rules were left open because the generated app "just worked" that way.
  • Credentials or API keys may be sitting in client-side code or in your repo history.
  • Forms and inputs were never checked for validation or sanitisation.
  • The site works on your laptop and you have no idea how it behaves under load.
  • Google has indexed little or none of it and you do not know why.
Get a Quote

Every engagement delivers all six

No tiered feature lists. The scope below is the standard engagement — anything beyond it gets quoted separately and agreed before we start.

Security review

Exposed secrets, unvalidated inputs, injection vectors, missing authentication checks, permissive CORS, and dependency vulnerabilities — the categories AI-generated code fails most reliably.

Dependency and integrity check

Packages that are outdated, abandoned, vulnerable, or simply hallucinated into existence by the model and never really needed.

Performance and Core Web Vitals

Unoptimised images, render-blocking scripts, oversized bundles, and the layout shift that generated markup tends to produce by default.

Accessibility assessment

WCAG-level issues across keyboard navigation, colour contrast, focus states, form labelling, and semantic structure — routinely skipped in generated markup.

SEO fundamentals

Titles, meta descriptions, heading hierarchy, canonicals, structured data, sitemap and robots configuration. Usually either absent or duplicated across every page.

Maintainability review

An honest assessment of whether a developer can pick this up and extend it, or whether you are heading for a rebuild in six months.

Website security by builder

Each AI builder fails in its own characteristic way. Knowing which tool produced the code tells us where to look first.

Lovable

Lovable app security questions almost always come down to Supabase: row-level security left disabled, the anon key treated as a secret, and client-side checks standing in for server-side authorisation. We verify the database rules directly rather than trusting the app's behaviour.

v0 & Bolt

Generated Next.js and React apps commonly leak server-only environment variables into client bundles, ship unprotected API routes, and skip input validation on server actions. We trace every route that touches data.

Cursor & Windsurf

Assistant-written code across a long session drifts — auth patterns applied inconsistently, validation on some endpoints and not others, and dependencies added and forgotten. We check for the gaps between sessions.

Replit Agent

Deployment configuration is the usual weak point: secrets in plain environment files, permissive CORS, debug modes left enabled in production, and databases exposed beyond the app.

ChatGPT & Claude

Hand-assembled snippets from a chat session rarely share a coherent security model. Each piece works; the seams between them are where injection, auth bypass, and unvalidated input live.

WordPress + AI plugins

AI-generated themes and plugins routinely miss nonce verification, capability checks, and output escaping — the exact issues that fail a WordPress.org security review and get sites compromised at scale.

Four stages, no mystery

You know what happens at each point, what we need from you, and when.

1

Handover

You give us repository access or a deployed URL, and tell us which tools built it. Knowing whether the output came from Lovable or from Cursor genuinely changes where we look first.

2

Automated sweep

Static analysis, dependency scanning, Lighthouse, and accessibility tooling run across the whole codebase to establish the baseline quickly.

3

Manual review

A human reads the code paths that handle data, authentication, and user input — precisely the areas automated tools miss and generated code gets wrong.

4

Report and triage call

Findings ranked as fix now, fix soon, or acceptable, with a call to walk through anything urgent. Critical security findings are reported the moment we find them, not held for the report.

What's in the engagement

  • Full security review of generated code
  • Secret and credential exposure scan
  • Dependency vulnerability and hallucination check
  • Core Web Vitals and performance diagnosis
  • Accessibility assessment against WCAG 2.2 AA
  • SEO fundamentals review
  • Maintainability and technical debt assessment
  • Findings triaged as fix now, fix soon, or acceptable
  • Triage call to walk through the report
  • Immediate disclosure of any critical security finding

A good fit if

  • Founders who shipped an AI-built site and are about to send real traffic to it
  • Anyone taking payments or collecting personal data through generated code
  • Teams inheriting a codebase nobody on staff actually wrote
  • Investors or buyers doing technical diligence on an AI-built product

Probably not yet if

  • Side projects with no users and no data — the audit will find issues, but none of them will matter yet. Wait until something is at stake.
from $1,000 one-time

Typical marketing sites and small apps. Complex applications quoted individually.

Every engagement is scoped and priced individually against your site — the figure above is where projects like yours typically start, not a placeholder for an upsell. You get a fixed quote in writing before any work begins.

Request Your Quote

No obligation · First response within 48 hours · Timeline scoped to your project

Questions people ask before booking

It depends almost entirely on how Supabase was configured, and that is the part Lovable does not force you to get right. The recurring issues are row-level security left disabled on tables holding user data, authorisation enforced in the UI rather than in database policies, and the service role key ending up somewhere the browser can reach. All three are invisible from the front end and all three are checkable in under an hour — which is the first thing we do on any Lovable audit.
Start with the cheap checks: search your repository history for keys and tokens, open your deployed site's network tab and look at what the client actually receives, confirm every database table has row-level security enabled, and run npm audit for known vulnerable dependencies. That catches a meaningful share of real problems for free. What it will not catch is authorisation logic that is wrong rather than missing, which needs someone to read the code — that is the part we do.
Anything that produced code we can read: ChatGPT, Claude, Lovable, v0, Bolt, Cursor, Windsurf, Replit Agent, and hand-assembled combinations of several. What matters is the output, not the tool. WordPress, Next.js, plain HTML and most common stacks are all in scope.
It is safe for production once someone has verified the security-critical paths — authentication, authorisation, data access, and secret handling. The risk is not that AI writes bad code; it is that nothing in the workflow prompts you to check those four things, so they ship unverified. Vibe coding plus one security review is a perfectly reasonable way to build. Vibe coding plus nothing is where the incidents come from.
Almost certainly not. AI-generated sites are usually structurally reasonable with a handful of genuinely serious gaps, and the point of the audit is to find those specific gaps rather than to talk you out of the approach. We will tell you clearly if a rebuild is the honest recommendation, but that is the rare case.
The audit is diagnosis. Remediation is quoted separately through our WordPress development service, or you can hand the report to any competent developer — findings are written so that someone who did not perform the audit can act on them.
We tell you immediately, before the report is finished, with enough detail to act that day. Exposed credentials and open data access do not wait for a delivery date.
The live URL alone gets you a partial audit. Repository access gets you the security and dependency review, which is where most of the value sits. We sign an NDA on request.

Tell us about your site.
We'll tell you what it needs.

Send us a few details and we'll come back within 48 hours to scope it properly.

No obligation · No sales sequence · A real person replies