Why AI-built sites are a favourite target
An AI builder writes the code that works first, not the code that is safe first. The most common result is a secret key placed in the front-end code, where anyone who opens the page source can copy it. Wiz, the cloud security company, reported that third-party API keys and service credentials were often hardcoded into the client-side JavaScript of vibe-coded apps.
The second is a database left open. Apps built on Supabase ship a public key on purpose, and the database rules are meant to protect the data. Wiz reported that attackers look for apps that expose that key, then check which tables they can read. If the rules were never set, or the master key ended up in the browser instead, the data is open to anyone.
The third is speed. Attackers do not wait: on our own decoys, a stolen fake cloud key was used to try for admin rights 2 hours 39 minutes after it was taken.
What the free scan checks on an AI-built site
From the outside, reading only what any visitor can see:
- secret keys in your public JavaScript, in 17 formats: AI services (OpenAI, Anthropic, Groq, xAI, OpenRouter, Hugging Face, Replicate), payments (Stripe), cloud (AWS, private keys), code (GitHub, GitLab, npm), store admin (Shopify) and email (SendGrid, Slack)
- a Supabase master key (service_role) in the browser: the key that skips every database rule. The public anon key is not flagged; it is meant to be public
- secret files open to anyone at the addresses attackers try first
- login and signup forms with no bot guard, judged one by one
- the five security headers, and hidden text aimed at AI agents
If the scan finds a key
Treat the key as stolen, because it may already be. Issue a new key in the provider’s dashboard, revoke the old one, and move the call that uses it to a server-side function (for Supabase, an Edge Function) so the key never reaches the browser again. Then ask your AI builder to keep secrets on the server: most will, once told.
The free result tells you what kind of key it is and what it can do. Which key and where goes only to the owner, after you prove the site is yours, because anyone can scan any site.
Apps drawn by JavaScript
Many AI-built apps send an almost empty page and draw everything in the browser. The scan reads the page the way a fast scanner does, so on these apps it cannot see forms or page text, and it says so on the result instead of quietly passing them. The key and file checks still run, because they read your script files directly.
Questions
Are websites built with AI less secure?
Not by nature, but the common mistakes are predictable: secret keys in front-end code, database rules never set, and no bot guard on login forms. Those are exactly what attackers scan for, so AI-built sites get checked first.
Is my Lovable or Supabase app safe?
The public anon key in your app is fine by design. The risks are database rules that were never set, and the service_role key ending up in the browser. The free scan flags a service_role key in your public JavaScript. Check your table rules in the Supabase dashboard too.
What should I do if my OpenAI or Anthropic key is in my front-end code?
Revoke it now and issue a new one, then move the AI call to your server. Stolen AI keys are resold, and you pay for whatever is run on them.
Does the scan change anything on my site?
No. It reads only what any visitor can see, the way a browser does. It never logs in and never submits a form.
Sources: Wiz: common security risks in vibe-coded apps, Our live decoys
Want it done for you?
Every result lists the fixes with starting prices, or I can look at your site with you. Pro re-checks it every week for $12 a month, 7 days free.