What we cite

• Primary source2025

  A 2025 CVE recorded that insufficient row-level security policies in Lovable allowed unauthenticated attackers to read or write arbitrary database tables in generated sites.

  Source: NVD (National Vulnerability Database), CVE-2025-48757

  Limitations: Scored 9.3 (Critical) by MITRE on the NVD record and 8.26 by the GitHub Advisory — two different scorers, both legitimate. Lovable disputed the CVE, arguing application data is the customer's responsibility. The underlying scan analyzed project homepages only.

• Primary source2025

  Of 1,645 Lovable projects analyzed, 170 (10.3%) had inadequate row-level security, exposing 303 vulnerable endpoints.

  Source: Matt Palmer

  Limitations: The researcher was employed by Replit, a competitor to Lovable, at the time of disclosure. The scan covered homepages only, so this is a floor on that sample rather than a population estimate. A widely-circulated claim that '70% of Lovable apps had RLS disabled' contradicts this primary research and is false.

• Vendor research2025, reconfirmed Spring 2026

  45% of AI-generated code samples failed security testing, introducing OWASP Top 10 vulnerabilities. Syntactic correctness improved sharply from 2023 to 2025 while security pass rates stayed flat at 45–55%.

  Source: Veracode, GenAI Code Security Report

  Limitations: Veracode sells application security testing, so it has a commercial interest in the finding. The study covered 80 coding tasks across 100+ models. Failure rates varied by language: Java 72%, C# 45%, JavaScript 43%, Python 38%.

• Peer-reviewed2025

  Across 2.23 million generated code samples, 19.7% referenced a package that does not exist, producing 205,474 unique fabricated package names. 43% of hallucinations repeat across runs.

  Source: USENIX Security Symposium

  Limitations: Peer-reviewed. The repeatability of hallucinated names is what makes dependency-registration attacks ('slopsquatting') practical.

• Primary sourceApril 2026

  A review of 43,000+ security advisories traced 74 confirmed CVEs to AI-generated code, including 14 critical and 25 high severity. Roughly 18 appeared across the second half of 2025; 56 appeared in the first quarter of 2026 alone.

  Source: Georgia Institute of Technology

  Limitations: The researchers state 74 is a floor and the true count is likely several times higher, since most AI-introduced flaws are never attributed as such.

• Vendor research2025

  Across roughly 20,000 repositories with GitHub Copilot activity, 6.4% leaked at least one secret, compared with a 4.6% baseline — a 40% relative increase.

  Source: GitGuardian

  Limitations: GitGuardian sells secret-scanning tooling. The comparison is observational, not controlled — repositories using Copilot may differ from the baseline in other ways.

• Primary sourceFebruary 2026

  A misconfigured Supabase row-level security policy on a widely-publicized AI-built social app exposed roughly 1.5 million API authentication tokens, 35,000 email addresses, and 4,060 unencrypted private messages.

  Source: Wiz Research

  Limitations: The application's founder stated publicly that he wrote none of the code himself. The issue was secured within hours of disclosure, and the researchers reported no evidence of malicious exploitation before the fix.

• Vendor research2025

  AI-assisted developers produced three to four times more code and ten times more security findings. Privilege-escalation paths rose 322% and architectural design flaws 153%, while syntax errors fell 76% and logic bugs fell 60%.

  Source: Apiiro

  Limitations: Apiiro sells application security software. The finding is also in tension with METR's research, which measured experienced developers working more slowly with AI assistance. Treat the direction as informative and the magnitudes as vendor-reported.

• Primary sourceJuly 2025

  An AI coding agent deleted a production database during an explicit code freeze, generated thousands of fictional records that masked the failure, and initially reported the deletion as unrecoverable when it was not.

  Source: The Register

  Limitations: A single widely-reported incident, not a measured rate. Replit responded publicly and shipped environment-separation changes afterward. It is cited here as an illustration of why environment boundaries matter, not as evidence of typical behavior.

• Primary sourcecurrent

  Supabase documents that the anonymous/publishable API key is designed to be exposed in client applications, and is safe to expose provided row-level security is enabled on every table it can reach.

  Source: Supabase documentation

  Limitations: This is the correction to the most common piece of misinformation in this niche. The genuine risks are (a) row-level security missing or written permissively, and (b) the service_role key reaching a client bundle, which bypasses row-level security entirely.