Before someone else finds them. A security self-audit for apps built with Lovable, Bolt, Replit, v0, Cursor or Claude Code: 75 checks you run without writing code, and ready prompts that get your AI tool to fix what fails.
4 PDFs, 333 pages · one-time payment $27
No code needed · PDFs in English or Italian · Every case we cite has a source
For apps built with
The first three checks of the Quick Scan, all critical. Answer for your app and see the verdict by the kit's own rule: one critical check that fails turns the light red.
Your verdict
Answer the three checks to see your verdict.
16,326
Supabase databases with tables anyone could read, over half with signs of personal data. UpGuard, September 2026 ↗
170
of 1,645 apps built with Lovable let anyone access their users' data. Semafor, May 2025 ↗
2,000+
vulnerabilities and 400+ exposed secrets across 5,600+ public vibe-coded apps. Escape.tech, October 2025 ↗
45%
of AI-generated code samples contained a known security flaw. Veracode, March 2026 ↗
| Check | Severity | Documented case |
|---|---|---|
| KEY-1 · No secret keys in your site's code or in public environment variables | Critical | A Stripe secret key sat in a VITE_ variable, which ships in the code every visitor downloads: 175 customers were charged $500 each before it was rotated. Anton Karbanovich, February 2026 ↗ |
| DB-1 · Supabase or Neon Data API: Row Level Security is on for every table, including tables the AI created | Critical | Moltbook: a Supabase key in the site's code and no RLS exposed 1.5 million API tokens and 35,000 email addresses to anyone, with write access too. Wiz, February 2026 ↗ |
| AUTH-3 · Sign-up is closed on internal apps, including the sign-up API | High | Base44: outsiders could register on private apps protected by single sign-on using only the app's public ID. Fixed in under 24 hours. Wiz, July 2025 ↗ |
| DEV-1 · Your coding agent has no production keys and development is separate from production | Critical | Replit's AI agent deleted SaaStr founder Jason Lemkin's production database against his explicit instructions, then wrongly said it couldn't be restored. The Register, July 2025 ↗ |
| RATE-6 · Hard spending caps are switched on for every service that offers one | Critical | A traffic spike ran up a Netlify bill of more than $100,000 for a simple static site. Netlify's CEO said the user would not be charged. Hacker News, February 2024 ↗ |
The Audit goes through your app one area at a time, from keys and database to payments, AI features and launch. Every check is Critical, High or Medium, so you know what to fix first.
At the end of the Audit comes the score sheet: mark every check OK, KO or N/A, add up the weights and read your verdict, red, yellow or green.
5 checks: 3 high, 2 medium
5 checks: 2 critical, 3 high
6 checks: 4 critical, 2 high
6 checks: 2 critical, 3 high, 1 medium
5 checks: 3 critical, 2 high
5 checks: 4 critical, 1 medium
7 checks: 4 high, 3 medium
7 checks: 1 critical, 4 high, 2 medium
6 checks: 1 critical, 4 high, 1 medium
6 checks: 1 critical, 4 high, 1 medium
8 checks: 3 critical, 4 high, 1 medium
9 checks: 2 critical, 4 high, 3 medium
Four PDFs that work together. The Quick Scan tells you where to start, The Audit finds the problems, The Prompt Pack gets your AI tool to fix them and the Developer Appendix explains the technical side. Each check keeps the same ID in every document, so you can move between them.
Click to enlarge
70 pages
75 checks in 12 areas that you run without writing code. Each one explains the risk in plain words, shows how to test it in your browser or dashboards, and ends with OK, KO or N/A. Your results produce a score and a traffic-light verdict.
Click to enlarge
88 pages
For every check, three ready prompts for your AI tool: Basic for chat builders, Medium when you want a plan first, Advanced for Cursor and Claude Code. Each comes with a way to verify the fix, and every area opens with a prompt that looks for all of its problems at once.
Click to enlarge
165 pages
The technical detail behind every check: how the problem works, code and configuration examples, automated tests and links to the official documentation.
Click to enlarge
10 pages
The 10 most urgent checks, to run first. About ten minutes, no code, and if one fails you know what to fix before anything else.
Every check keeps the same ID in all four PDFs, so you can move from one document to another without losing your place.
The Developer Appendix has the technical detail behind every check, for you or the developer you work with.
Every check in the kit follows the same structure, so you always know what to do next.
PDFs in English or Italian: you get the language of the site you buy from.
$60−55%$27One-time payment
Ends in
333 pages in four PDFs
Digital Products. These are digital products (PDF documents) delivered by email as educational material. The kit lowers risk but can't make any app completely secure, and it doesn't replace a professional penetration test. No refunds. The PDFs are digital content that you receive right after payment: at checkout you ask for immediate delivery and acknowledge that, once they are delivered, you lose your right of withdrawal. The price covers version 1.0 (October 2026). Updates are not included. By purchasing, you agree to our Refund Policy, Terms and Conditions, and Disclaimer.
Four documented cases from 2025 and 2026, with their public sources. Every one of them matches checks in the kit.
In the kit: KEY-3, AI-1, RATE-7
A three-developer startup in Mexico usually spent about $180 a month on Google Cloud. On 11 and 12 February 2026 someone used its stolen API key to call Gemini: $82,314 in charges in 48 hours. Google's support pointed to the shared responsibility model, under which protecting keys is the customer's job.
The Register (opens in a new tab) · March 2026
In the kit: DB-1
Two researchers scanned 1,645 web apps built with Lovable and featured on its site. In 170 of them, anyone could access information about their users, including names, email addresses, financial information and secret API keys, because the Supabase database was not configured correctly.
Semafor (opens in a new tab) · May 2025
In the kit: KEY-1, PAY-1
A founder building with Claude Code and Vite reported that his Stripe secret key sat in a variable starting with VITE_, which Vite puts into the code every visitor downloads. Before he could rotate the key, 175 customers were charged $500 each and he lost $2,500 in Stripe fees.
Anton Karbanovich (opens in a new tab) · February 2026
In the kit: DEV-1, DEV-3
In July 2025 SaaStr founder Jason Lemkin was building an app with Replit when its AI agent deleted his production database, against his explicit instructions. The agent then said a rollback was impossible. The rollback worked.
The Register (opens in a new tab) · July 2025
Start with the 10 most urgent checks in the Quick Scan, then work through all 75 in The Audit, with a ready prompt for every fix.
One-time payment. No subscription.
The real cases in the kit come from public reporting and security research, each with a link to its source. The technical guidance follows the official documentation of each platform and established security standards.
OWASP
Open security standards: testing guide, cheat sheets and the API Security Top 10
Supabase documentation
Database security, API keys, Auth and cost control
Firebase documentation
Security Rules, Auth and billing
Stripe documentation
Payment security, fraud prevention and order fulfilment
Cloudflare documentation
SSL/TLS, caching, firewall rules and bot protection
Next.js and Vercel documentation
Framework security, security releases and spend management
Wiz
Security research on Base44, Moltbook and the common risks of vibe-coded apps
The Register
Reporting on AI coding incidents, including the Replit agent that deleted a production database
Semafor
Reporting on the 170 apps built with Lovable, out of 1,645 scanned, that left user data open
Named only to show what the kit covers. Maximum Protection is independent and is not affiliated with, or endorsed by, any of these companies. Trademarks belong to their owners.