Scan of 100 Lovable-built apps finds widespread missing security headers and weak GDPR compliance

·1 views

A developer behind the Vespez scanning tool checked 100 apps from Lovable's public showcase for security and GDPR issues. Fourteen of the apps were already offline within weeks of being published, leaving 86 that received full scores. Nearly all lacked a Content-Security-Policy header, and most could be embedded by other sites, a gap the author attributes to platform defaults rather than individual choices. Average GDPR scores came in at 38 out of 100, with no app achieving a clean result, and one app exposed a live API key in its public JavaScript. The author notes the scan is a non-legal assessment of a non-random sample, so low scores indicate likely issues rather than confirmed violations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Frameworks or Libraries? How Solo Developers Can Choose the Right JavaScript Tool

Solo tech founders often struggle with scalability and resource limits, making the choice between JavaScript frameworks and libraries a critical early decision. Frameworks such as React, Angular, and Vue.js provide built-in structure and speed up launches, but they carry a steeper learning curve and risk lock-in. Libraries offer greater architectural freedom and lighter footprints, though they require more upfront planning and integration effort. The article illustrates trade-offs through examples like real-time financial dashboards and social analytics tools, noting where Angular's data binding or React's component model may fit. It concludes that the right choice depends on how well the tool's philosophy aligns with the project's operational strategy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds tool that logs bug fixes and flags repeated mistakes before commit

The author notes that the same credential-leak bug in the Python requests library was fixed in 2014 and again in 2023, because the lesson was buried in git history. Similar redirect-credential bugs have been fixed at least 47 times across 22 projects since 2014. To counter this, the author built Bug Diary, a local tool that automatically writes post-mortems for fix commits using Gemma 4 and checks new changes against past lessons. It runs entirely on a laptop with Ollama and a SQLite file, and a demo shows it catching a repeated race condition in a separate project's token refresh code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Orquesta Commits Every AI Agent Action to Git for Full Traceability

The developers of Orquesta argue that AI agents modifying a codebase should be held to the same traceability standards as human developers. Their platform records each discrete agent action, such as a file edit, shell command, or test fix, as a separate git commit with its own diff, timestamp, and message. The agent works on dedicated branches under its own git identity, so changes can be distinguished from human work. The authors contrast this with tools that either leave AI edits uncommitted or bundle a whole session into one opaque commit, which makes review and selective rollback difficult. Granular commits, they say, let teams see exactly what changed, when, and why, and revert only the problematic step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agent Ran Approved Command 40 Minutes After Sign-Off, Prompting Time-Limited Lease Tool

A developer who uses coding agents on a propose-approve-execute workflow found that a command they approved at 10:00 was run at 10:40, after the approval had gone stale. In response, they built leaseguard, a single-file, zero-dependency Node 18+ tool that turns an approval into a time-limited grant tied to a specific command and note. Before execution, the gate checks the lease and a standing deny policy, which takes precedence over any valid lease. The tool also keeps an audit log of what ran and what was denied. The author notes it is not designed to stop a determined adversary with access to the local file system.

0 comments Read more at DEV Community