I scanned 100 apps built with Lovable. 14 were already dead. 1 leaked a live API key.

I build Vespez (vespez.com), a tool that checks web apps for security and GDPR issues. I wanted a real answer to a question I kept asking myself: AI tools make it trivial to ship an app, do they make it trivial to ship a safe one?

So I pulled 100 apps from Lovable’s own public showcase and ran every one through the same scan Vespez runs on any site: a headless browser loads the page, records what fires before the visitor clicks “accept” on consent, checks the response headers, and reads the privacy policy if one exists.

The numbers

100 apps checked. 14 were already offline within weeks of being shown off publicly. 86 got a full score.

Average security score: 77/100. Average GDPR score: 38/100.

One app was leaking a live OpenAI API key in its public JavaScript bundle, readable by anyone who opened dev tools. Not naming it, that gets reported privately, not broadcast.

What showed up constantly

96% have no Content-Security-Policy header. 92% can be embedded by another site (clickjacking). These travel together, 92% are missing both at once. That’s not 92 separate decisions, it’s a platform default: Lovable doesn’t set these headers for you, so unless someone specifically knows to add them, they just don’t exist.

55% load Google Fonts straight from Google’s servers. Same story, template default, not a deliberate choice, and also exactly the kind of third-party data flow GDPR actually cares about.

57% have no findable privacy policy. 63% have no terms of service. This part actually is on the builder, not the platform.

The cleanest result in the whole set: whether a consent banner existed was almost perfectly predictive of behavior. Apps with one loaded trackers before consent only 10% of the time. Apps without one did it 96% of the time. When the banner exists, it works. The gap is that 23 of 86 never added one.

Zero of the 86 scored a clean GDPR sheet. Three had zero security findings.

A smaller pattern worth a mention

Split by domain: apps still on a lovable.app subdomain averaged a GDPR score of 44. Apps that moved to their own custom domain averaged 34, worse, not better. Small sample (36 vs 50), so I’d call it a pattern worth watching rather than a law, but it’s a real one: moving to your own domain is usually a sign you’re treating it as a real product, which makes the gaps matter more.

Method, so you can judge it yourself

I took 100 apps from Lovable’s public showcase, via each project’s own “Visit website” link.

Each app got one scan: headless browser render, response headers, network requests and cookies recorded before any consent interaction, and privacy/terms pages read when findable.

Security findings are deterministic checks against the page and headers. For GDPR findings, where a privacy policy exists, an AI model reads it and checks what it says against what the site actually does.

Nothing from the pages was kept beyond scores and findings, same policy as real Vespez accounts.

14 apps were unreachable and excluded from the scores above.

Not a legal audit, a scan. Low score = likely issue, not a confirmed violation. Sample is a public AI-builder showcase, not a random slice of the web.

Curious if anyone’s seen similar patterns scanning their own AI-generated output, or if I’m missing an angle on the methodology.