Research · 30 October 2026

We scanned 50 apps built with AI tools.

Not a survey, and not somebody else's research. We pointed our own checker at 50 real applications that strangers built with Lovable and Bolt, read the code of the 47 still public when we ran it, and published what came back. No app is named here, and none ever will be.

What we found

Someone had left a key in the code: Like taping your shop key to the front door. Anyone who can read the code can copy it and use the app’s accounts as though they were the owner.; 18 of 47
A stranger could run up their bill: These apps pay a small amount every time they send a text message or ask an AI something. Nothing stopped one person doing that a hundred thousand times overnight. The bill is how the owner would find out.; 17 of 47
What a visitor types could reach too far: Somebody types into a box on the site. Instead of being treated as words, it reaches a part of the app that treats it as an instruction to follow.; 13 of 47
Their stored information could be read by a stranger: Whatever the app keeps about its customers, open to anyone who knows where to look.; Why only 6? To check this we need a working website to visit. Most of these 50 were code with no site running, or the site gave us no way to find where the information was kept. So we could only try it on 6. The other 44 are not “safe”, we simply could not look.; 1 of 6
Outside code with a known problem in it: Every app is built partly from other people’s code. Some of those pieces have known faults that were fixed in a later version.; Our September study said none. That was wrong. Our check had a fault: when it could not get GitHub’s own warnings about an app, it stopped before reading the app’s parts, and reported nothing found when it had not looked. We fixed it on 9 October, and this is the first study run with the fix.; 32 of 47

How the 50 were chosen

We searched GitHub for public repositories, then confirmed each one by a file the tool itself writes. Lovable adds a package called lovable-tagger to what it generates; bolt.new writes a .bolt/config.json. Both are the tool's own output.

That confirmation is not a formality. The first ten results of the Lovable search included two “awesome list” repositories, which are not applications at all. A repository that mentions a tool is not an app built with it, and a study that counted those would be measuring blog posts.

Forks and archived repositories were skipped. Results were taken newest first, because a study of abandoned projects is easy to dismiss. No repository appears twice.

What we did to each one

We read their code. A shallow copy of the public repository, read once, then deleted. Public repositories are published, and reading published material is settled ground.

We asked their database how many rows it had, and never asked for a row. Where an app had a site we could reach, we found the public key the site already hands every visitor, then asked each candidate table for a count. The answer comes back as a number in a header with no data attached. That proves a table is readable by a stranger without a single row of anybody's information reaching us.

We changed nothing, signed in to nothing, and opened no private screen. That is not restraint on our part; it is built in. Our checker will not run those tests at all until somebody has proved a site is theirs, and no app in this study did.

What these numbers do not say

This is about the apps, not about the tools. A key left in the code is something the person building it did, not something Lovable or Bolt wrote for them. We measured what fifty finished apps looked like. We did not test whether one tool produces safer work than another, and nothing here should be read that way.
When we could check a database, we were guessing at the names. With only the public key a visitor gets, an app will not tell you what its stored information is called, so we tried a list of common names. Finding nothing that way is weaker than finding nothing in a real list, and none of the 6 gave us a real list.
50 apps is a sample, not a census. All of them were public, and somebody who publishes their code may be more careful, or less, than somebody who does not. We cannot tell which from 50.

What we will never publish

No app, domain, repository or owner is named, here or anywhere. No screenshot, no row of anybody's data, no column name. Row counts are published in bands rather than as exact figures, because a precise number can point back at a single app. A tool with fewer than five apps in the sample is folded into “other” for the same reason.

The per-app records exist on one machine, are not part of this site, and are kept for one purpose: if we ever find an app exposing real personal data and its owner is contactable, they get told, whether or not they ever become a customer.

Ours is not the only one. What WIRED, The Register and university researchers have published about these apps, with a link to each.

GuardCue is a security and quality check for apps built with AI tools, written for the person who built it rather than for a developer. The same checker that produced these numbers is the one that runs when you paste in your address. Check your own site, free.