Vibe Coded App Security Checklist: Taking a Base44 or Lovable App to Production

TL;DR: Base44, Lovable, Bolt and Cursor take you from an idea to a working app in days. That makes them excellent for prototypes, demos and testing demand. The trouble starts when real users and real data arrive: missing permission checks, open database tables, keys in the browser, no tests and no monitoring. Run the checklist below before launch. If the data model or the permission logic is wrong at the core, rebuild, and use the prototype as your spec.

Last checked: September 2026. This is general information, not legal advice.

What vibe coding tools do well

Vibe coding means you describe an app in plain language and an AI agent writes it. The tools work differently:

• Base44 and Lovable build the whole app for you, including the database, login and hosting.
• Bolt works in a similar way, in the browser.
• Cursor is an AI code editor for developers. The code sits in your own repository from day one.

Base44 is an Israeli success story. Maor Shlomo built it alone, with no outside funding, and Wix acquired it in June 2025 for about $80 million plus earn-out payments. At the time, Ctech reported that about a quarter of its users were in Israel.

These tools are hard to beat for three jobs:

• A prototype people can click. A founder shows investors a working flow instead of a slide.
• Testing demand. You put a real app in front of early users and watch what they do.
• Internal tools and demos. A dashboard for a small team, or a sales demo for one meeting.

What went wrong in 2025: three public incidents

Each incident maps to a check you can run on your own app.

Base44: private apps open to strangers. In July 2025, Wiz Research found that two sign-up endpoints on Base44 required no authentication. With only an app's ID, which appears in its URL, an attacker could create a verified account on a private app and skip its single sign-on. Wix fixed the flaw within 24 hours and found no evidence that anyone had exploited it. The check for you: who can register to your app, and have you tried it?

Lovable: databases anyone could read. Researcher Matt Palmer reported Lovable projects whose Supabase databases had missing or weak row-level security (RLS), filed as CVE-2025-48757. According to Semafor, 170 of the 1,645 Lovable apps scanned exposed data such as names, emails, financial details and API keys. Lovable disputes the CVE and says each customer is responsible for protecting their own app's data. That is the lesson: the platform gives you a database, and the rules that protect it are yours.

Replit: a production database deleted. In July 2025, The Register reported that Replit's AI agent deleted SaaStr founder Jason Lemkin's production database during a declared code freeze. The check for you: keep development and production apart, and know that your backups restore.

Wider research agrees. In October 2025, Escape scanned more than 5,600 public vibe-coded apps and found more than 2,000 vulnerabilities, more than 400 exposed secrets and 175 cases of exposed personal data, including medical records and bank account numbers. Studies of AI-generated code in general agree; see our playbook for testing AI-generated code.

The vendors have responded. Lovable now scans every app on publish, flags tables without per-record access rules and warns you when you paste an API key into the chat. Its own documentation says these tools "cannot guarantee complete security" and advises a professional review for apps that handle sensitive data. We agree.

Where a demo and a production app part ways

The AI builds what you ask for. Most people ask for features, so these parts get skipped:

• Permissions. The app knows who you are. It often never checks what you may see. A hidden button still leaves the data one direct request away.
• Row-level security. In apps built on Supabase, every table needs rules for who can read, add, change and delete each row.
• Keys in the browser. Everything in the browser code is public. Keys for AI services, payments or email belong on the server. A leaked AI key lets strangers run up your bill.
• No tests. Each new prompt can break an old flow, and nothing warns you.
• No monitoring. When something fails at night, you hear about it from a user.
• A data model built for the demo. Missing indexes, duplicated data, one login per company when you need teams and roles. It holds up in the demo and slows down as data grows.
• Vendor lock-in. Base44 syncs your code to GitHub on its Builder plan and above, and its docs show the synced app still runs against the Base44 backend. Leaving means replacing that backend. Lovable syncs a React project to GitHub and can run on a Supabase project you own, which makes the exit shorter.
• Privacy law. An app that stores personal data about people in Israel falls under the Privacy Protection Law, and Amendment 13 has been in force since August 2025. Ask your lawyer what applies to you.
• Accessibility. Public-facing services in Israel must meet Israeli Standard 5568. Generated screens often lack form labels, visible focus and enough contrast.

Vibe coded app security checklist

Run this before real users or real data touch the app. Most items take minutes to a few hours.

1. Test access as a stranger. Log out, take the key the browser uses, and query your database and API directly. Then log in as user A and try to read user B's records.
2. Turn on RLS for every table, with a separate policy for read, insert, update and delete. A green scan tells you a rule exists. Your own test tells you it is correct.
3. Lock down sign-up. For internal apps, use invitations or enforce single sign-on, then try to register from outside and confirm it fails.
4. Move keys to the server. Search the built JavaScript for keys. Replace every key that ever appeared in a prompt, in code or in git history.
5. Check permissions on the server. Every function that reads or changes data confirms who the user is and what role they hold.
6. Validate input on the server, and add rate limits to login, sign-up and AI endpoints.
7. Separate development from production, database included. Turn on backups and do one test restore.
8. Write tests for the flows that hold money or data: sign-up, payment and permissions.
9. Add error tracking and alerts, plus a log of who changed what.
10. Review the data model against next year's plans: teams, roles, reports and integrations.
11. Map personal data: what you collect, where it is stored, who can see it and how long you keep it.
12. Check accessibility with a screen reader and with the keyboard alone.
13. Plan your exit. Export the code and the data once, and write down what it would take to run them elsewhere.

When a development team uses AI coding agents every day, the same risks appear at scale. Our secure coding agents setup handles that case.

Harden or rebuild?

Most vibe-coded apps can be hardened. Some need a rebuild. It depends on what is wrong and where.

A rebuild keeps what the prototype taught you. It becomes a working spec that has already answered the product questions, so the new build moves faster. With our agentic development process, a web MVP starts at $20K, and an MVP typically costs $25K-$60K and takes 3-6 weeks. If you are weighing who should build it, read should you hire an agency for your MVP.

What a code audit of a vibe-coded app looks like

A code audit answers one question: can this app safely carry real users, and what will it take? For a vibe-coded app we focus on:

• Access. We attack the app the way the incidents above did: as a stranger, and as another user.
• Keys and dependencies. Secrets in the browser bundle and in git history, and packages with known vulnerabilities.
• Data model and scale. Whether the schema supports your roadmap, and which queries will slow down first.
• Platform exposure. What runs on the vendor, what you can export, and what leaving would cost.
• Privacy and accessibility gaps, flagged for your lawyer and your designer.

You get a prioritized list of findings and a clear recommendation: harden, rebuild, or harden now and rebuild the core later. Our audits take 2-4 weeks and cost $8K-$20K, scoped upfront by the size of the codebase. What a code audit delivers shows the full report.

Frequently asked questions

Is Base44 secure? Base44 fixed the sign-up flaw Wiz found in July 2025 within 24 hours, and Wix found no evidence of exploitation. The platform runs hosting and login. Your app's security still depends on your sign-up, permission and data access settings, so test them before launch.

Base44 or Lovable: which should I choose? Both build full apps from a prompt. Base44 comes with its own backend, and code synced to GitHub still runs on it. Lovable produces a React project, syncs it with GitHub and can run on a Supabase project you own, which makes it easier to move later. For a prototype, pick the one your team works faster in. For a product, compare the exit paths.

How much does Base44 cost? Base44 has a free plan. In September 2026 its paid plans run from $16 to $160 a month, billed annually, and GitHub sync starts at the Builder plan. The subscription is the small part of the budget. Plan for a security review, and for fixing what it finds, before launch.

Can Lovable build a Hebrew app? Yes. You can describe the app and ask for a Hebrew, right-to-left interface. Then check the places where RTL usually breaks: mixed Hebrew and English text, numbers and dates, form alignment, icons that should flip and email templates.

How much does it cost to audit a vibe-coded app? Our code audits cost $8K-$20K and take 2-4 weeks, scoped upfront by the size of the codebase.

Built something with Base44, Lovable, Bolt or Cursor and ready for real users? Tell us about it, and we'll tell you what it needs before launch.