Audit a Cursor or v0-Built MVP Before You Launch

Short summary

A practical security audit guide for founders who built MVPs with AI coding assistants like Cursor, v0, Lovable, and Bolt. Identifies three vulnerability classes found in 80% of AI-generated apps: BOLA (missing ownership checks), disabled Supabase Row-Level Security exposing all data via the public anon key, and server-side secrets leaking into client bundles. Each issue includes a concrete fix and a verification command runnable in under a minute.

• •BOLA is the #1 finding: AI assistants consistently skip ownership checks in API routes — fix is a single WHERE clause
• •83% of exposed Supabase instances have RLS disabled; verify with a curl command using your public anon key
• •Secret keys leak into client bundles when AI imports server modules into Client Components; grep build output and use server-only package

Generated with AI, which can make mistakes.