Written for founders who built with an app builder.
Ordered by what a stranger reaches first. Each links to a self-check you can do today and to what our test adds.
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack.
Any website a signed-in user visits can call your API with that user's session and read the response, so their data leaves for a site you never approved.
A published advisory is a public instruction sheet, so an attacker does not need to find a flaw in your code; they only need to know which library version you run.
An old reset email found in a shared inbox, a forwarded thread or a breached mailbox lets someone take over the account months later.
Genuine reports look like the one that found an inverted access check in an app with tens of thousands of user records: specific steps, a specific table or route, and a suggested fix (Taimur Khan, 2026). Vague reports that only list missing headers or a version number are usually scanner output. Reproduce the specific ones with the self-checks below before you reply.
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
Feb 2026 · Taimur Khan · all sources
On the Base44 app builder, undocumented registration and one-time-password endpoints accepted a non-secret app_id, so anyone could create a verified account on a private app; Wix fixed it within 24 hours.
Jul 2025 · Wiz Research · all sources
For anyone who wants the three riskiest areas checked fast.
$290
For the day something has already gone wrong.
$790
Compare all packages, or run the self-check first.
Genuine reports give reproducible steps against a specific route, table or file and do not demand payment before details. Scanner-based emails list generic items like missing headers or an old library version and often ask for a bounty. Reproduce the specific claims with the self-checks above; thank and fix the real ones.
You are not obliged to. If the finding is real and specific, a thank-you and, if you can, a modest reward keeps researchers reporting to you instead of elsewhere. Never pay for details before you have seen enough to reproduce the issue.
Follow the reporter's steps with a test account, with the browser's network tab open. If you cannot reproduce it, ask for a screen recording. If you can, fix it, re-test, and check whether the same shape exists elsewhere. The security sweep does this in 24 hours if you want a second pair of hands.
Other moments: before you launch, before you take payments, before an investor or security review, before a client handover, after something went wrong.