Library
Every break
36 cards. Filter by the tool that generated the app, or by what you are seeing.
36 breaks
Exposed data
Supabase tables ship with row level security off
The app looks correct while you are signed in. A request that carries only the publishable key, and no user session, can still read or write a table.
Lovable · Bolt · Cursor · Replit · v0 · Supabase
Exposed data
A policy uses USING (true) on private rows
Row level security is on, and the app still returns every row to any signed-in user, or to nobody at all.
Lovable · Bolt · Cursor · Replit · v0 · Supabase
Exposed data
Table grants stay wide open after policies are added
You added policies, then a signed-out client can still insert, or a signed-in client can still delete rows the policy was meant to hide.
Lovable · Bolt · Cursor · Supabase
Exposed data
A view bypasses row level security
The table policies look right. A view the app selects from still returns every row.
Lovable · Bolt · Cursor · Supabase
Secrets
The service role key is in the browser bundle
Data API calls from the site ignore every row policy. Searching the shipped JavaScript turns up a secret or service role key.
Lovable · Bolt · Cursor · Replit · v0 · Supabase
Secrets
A VITE_ variable bundles a secret into the client
An API key works in the browser preview. Anyone who opens the built JavaScript can read it.
Lovable · Bolt · Cursor
Secrets
NEXT_PUBLIC_ inlines a secret at build time
A key was added as NEXT_PUBLIC_ so a client component could read it. The production bundle contains the value.
Cursor · v0
Secrets
A Client Component reads a server environment variable
The variable is not prefixed NEXT_PUBLIC_, but the secret still shows up in the HTML of a page that renders a Client Component.
Cursor · v0
Auth
An Edge Function turns auth off and never checks the caller
A function that changes data or spends money returns 200 with no session. It was set to verify_jwt = false, or auth: 'none', to clear a 401 during development.
Lovable · Bolt · Cursor · Supabase
Exposed data
The admin client returns every user's rows
The function checks that someone is signed in, then a query through the admin client returns the whole table.
Lovable · Bolt · Cursor · Supabase
Payments
The Stripe webhook accepts an unsigned body
A payment shows as paid, or a paid feature unlocks, when a request hits the webhook URL without a valid Stripe signature.
Lovable · Bolt · Cursor · v0 · Replit
Over-open rules
Firebase rules allow every read and write
The app was created in Firebase Test mode, or the rules say allow read, write: if true. Anyone who knows the project can read and overwrite the data.
Firebase · Cursor · v0 · Lovable · Bolt · Replit
Over-open rules
Any signed-in Firebase user can read the whole database
Signed-out visitors are blocked. Any account, including one you just created, can read and write every document.
Firebase · Cursor · v0 · Lovable · Bolt
Over-open rules
A deeper Firebase rule cannot take access away
A child path sets ".read": false, and clients can still read it.
Firebase · Cursor · v0
Auth
The app freezes after sign-in
Login returns, then the next Supabase call never comes back. The screen stays on a spinner.
Lovable · Bolt · Cursor · Supabase
Auth
OAuth comes back to the wrong host
Google or GitHub sign-in leaves the user on localhost, on a preview URL that errors, or on the site with an error in the URL hash.
Lovable · Bolt · Cursor · v0 · Supabase
Auth
Confirmation and reset emails point at localhost
Sign-up works in the builder preview. The email link opens localhost, or the production site never receives the token.
Lovable · Bolt · Cursor · Supabase
Storage
A public Storage bucket serves private files
A document or invoice URL loads in a private window, with no login.
Lovable · Bolt · Cursor · Supabase
Storage
Storage upload returns 403 even with an insert policy
Upload fails with 'new row violates row-level security policy' even though the insert policy looks correct and the user is signed in.
Lovable · Bolt · Cursor · Supabase
Build limits
Bolt says the project is too large
Prompts fail with a project-size or prompt-size error. Bolt is reading more source than the context window can hold.
Bolt
Build limits
Bolt builds half of a long prompt
One message asked for several features. The preview has some of them, and the rest were dropped with no error.
Bolt
Build limits
Bolt stops responding mid-build
The chat spinner never finishes, or Bolt repeats the same edit and does not take new instructions.
Bolt
Publishing
Bolt projects disappear after sign-in
The project list is empty, or it is a different set of projects than the ones you built yesterday.
Bolt
Build limits
Bolt edits a huge file and breaks something else
A small UI fix rewrites a file that is hundreds of lines long, and an unrelated screen regresses.
Bolt
Secrets
A secret was pasted into the Replit Agent chat
The agent asked for a key, you pasted it into the prompt, and now the value is in the chat history instead of Secrets.
Replit
Secrets
A legacy Replit database URL was shared
Someone pasted DATABASE_URL into a ticket, a chat, or a client. On the legacy Neon database, that string is enough to connect.
Replit
Publishing
Lovable's scan finds issues and publish still continues
The publish dialog reports critical findings. The app goes live anyway, because blocking publish is a workspace setting and it is off.
Lovable
Secrets
An API key was pasted into the Lovable chat
You pasted a provider key into chat so Lovable could wire up the feature. The key is now in the transcript, and maybe in client code.
Lovable
Auth
The UI hides a page, and the API does not
The admin screen is hidden unless a localStorage flag is set. The request that loads the data still succeeds without that flag.
Lovable · Bolt · Cursor · v0 · Replit
Secrets
.cursorignore does not keep a secret from the agent
A .env file is listed in .cursorignore, and the agent still reads it through the terminal or an MCP tool.
Cursor
Auth
A private Base44 app could be joined with only its public app id
The app was set to private, including SSO-only, and a registration still succeeded for someone who only knew the app id from the address bar.
Base44
Auth
A Base44 login could hand the account token to another site
Signing in on Base44 could send the account token to a site you did not mean to visit, or into an app built on the platform.
Base44
Over-open rules
A Base44 table lets anyone read or change rows
Orders, messages, or other private records are visible to every visitor, including people who are not signed in.
Base44
Auth
A Horizons app on Supabase fails sign-in or an RLS check
Sign-in loops, a row-level security error appears right after signup, or the app cannot read its own Supabase tables. This is a setup failure, not a reported break-in.
Hostinger Horizons · Supabase
Secrets
An Emergent app commits a live secret in backend/.env
backend/.env is in the repository, and it holds a third-party API key or a JWT signing secret rather than an empty placeholder.
Emergent
Secrets
A secret was pasted into the Emergent chat
The agent asked for a key, the real value went into the prompt, and that value is now in the chat instead of the Secrets tab.
Emergent