Researchers: 5,000+ web apps built using AI coding tools like Lovable, Base44, and Replit have little to no authentication, and ~40% exposed sensitive data
Companies like Lovable, Base44, Replit, and Netlify use AI to let anyone build a web app in seconds—and in thousands of cases …
Context & Ripple Effects
Related coverage had already identified a critical flaw in apps made with Lovable that could expose API keys and users’ personal information. This report broadens the concern from an individual product vulnerability to a recurring security failure across AI-assisted app-building tools.
The pattern also resembles earlier low-code exposure incidents on Microsoft Power Apps and reports that organizations are struggling to review the growing volume of AI-generated code. The issue is therefore not simply code generation, but whether deployment defaults and review processes keep pace with it.
First-order effects
- Thousands of deployed apps built with Lovable, Base44, Replit, and Netlify-linked AI tooling may require immediate authentication and data-exposure reviews; affected app operators face remediation work and potential user-data risk.
- The named platforms face pressure to strengthen secure-by-default templates, deployment checks, and warnings around authentication and sensitive-data handling.
Second-order effects
- Organizations using AI app builders will need to treat generated applications as production software requiring security review, rather than as low-friction prototypes that can be published without governance.
- Security teams and platform vendors are likely to focus more on automated detection of exposed secrets, public data stores, and missing access controls, because manual review becomes harder as AI increases application output.
Third-order effects
- If such failures persist, the competitive advantage of AI coding platforms will increasingly depend on guardrails in the build-and-deploy workflow, not just how quickly they generate an app.
- The recurring connection between low-code and AI-generated app exposures points toward a broader shift: democratized software creation expands the population of publishers who must manage authentication, data access, and security operations.
The trend: AI-assisted development is moving software bottlenecks from writing code toward securing, reviewing, and governing the much larger volume of applications that can now be deployed quickly.