I scanned 100 AI-generated apps for security vulnerabilities. Here's what I found.

I've been building a security scanner for the past few months, specifically designed for apps built with AI coding tools like Cursor, Lovable, Bolt.new, and v0. To validate whether the tool was actually useful, I scanned 100 real GitHub repos - all built primarily with AI assistance. The results were worse than I expected. The numbers 67 out of 100 repos had at least one critical vulnerability 45% had hardcoded secrets (API keys, JWT secrets, database URLs in source code) 38% had missing authentication on sensitive API routes 31% had SQL injection or XSS vulnerabilities 89% of Lovable apps were missing Supabase Row Level Security policies This isn't a theoretical exercise. These are real apps, some already deployed with real users. The most common vulnerabilities by AI tool Cursor The biggest issue with Cursor-generated code is IDOR (Insecure Direct Object References) . Cursor loves to use sequential IDs and often skips ownership checks: javascript // Cursor generates this — anyone can