Bolt vs. Replit vs. Lovable: who checks your app's security?
Cyfendo
· 3 min read
All three platforms now scan apps for security problems, and all three leave responsibility for the result with the app's owner. Lovable scans database rules and dependencies when you publish and offers a deeper code review on request. Bolt checks on publish and, on paid plans, runs a full audit that fixes most problems itself. Replit checks packages for known vulnerabilities and, on paid plans, reviews source code and can test the running app. Lovable's and Replit's documentation both say their scans are not a complete security review.
What each platform checks
This comparison is based on each platform's documentation as of October 2026. These features change often, so check the linked pages before relying on a detail.
| Lovable | Bolt | Replit | |
|---|---|---|---|
| Automatic check on publish | Quick scan: database access rules, critical npm vulnerabilities, MCP servers exposed without sign-in | Security check on publish | Lightweight pre-publish scan |
| Deeper review | Deep scan of all code, started from the Security view | Security audit of code and database from the Publish menu (paid plans) | Security Agent reviews source code (paid plans); a further level also tests the running app |
| Fixes | Per-finding fixes; optional auto-fix for critical database and dependency findings | Fixes most problems itself and lists the rest | Findings can be sent to Agent; Auto-Protect prepares dependency patches |
| Can block publishing | Yes, if a workspace admin enables it | Not documented | Yes, for critical findings, if the setting is on |
| Third-party options | Wiz and Aikido integrations, paid separately | Not documented | Not documented |
Sources: Lovable security documentation, Bolt release notes, Replit security scanner documentation.
What the platforms say about their limits
- Lovable says its tools cannot guarantee complete security and recommends an additional professional review for apps that handle sensitive data. When a researcher reported that 170 Lovable apps exposed their databases (CVE-2025-48757), Lovable disputed the CVE on the grounds that each customer is responsible for their own app's data.
- Replit says a scan is not a complete security review and should be paired with code review, tests and checks of the running app.
- Bolt says its audit fixes most problems and tells you about anything you need to handle yourself.
No scanner knows an app's business rules unless they are written down somewhere it can read: which users should see which records, or which actions need which role. A scanner can find a table with no access rules. It can't tell that a team manager is seeing another team's records when the policy technically allows it.
Gaps that remain
- Checks mostly happen at publish time. An AI agent can change data access many times between publishes, and a problem introduced early may sit in the app for days before anyone scans.
- The platform reviews its own output. The same platform, often the same agent, writes the code, scans it and fixes the findings. A separate reviewer adds a second opinion.
- Scans don't show whether a finding can be used. They report code that looks risky. Whether an attacker can use it is a separate question, and the answer decides what to fix first. Our article on exploitability validation covers how that question gets answered.
Where Cyfendo fits
Cyfendo connects to all three platforms through their connector settings. Once connected, the agent asks Cyfendo to check each task that changes sign-in, permissions, data access, payments, uploads, API routes or secrets. Cyfendo tries to reproduce an attack against the changed code in an isolated sandbox, using a stand-in Supabase with two test users when the app uses Supabase, and reports the issues it reproduces along with fix steps.
Keep running each platform's own scan as well. Setup guides: Lovable, Bolt, Replit.