reddit · SideProject · 09-29 06:50 70 分 ← 返回列表

I scanned 100 AI-built apps for security issues. Here’s what I found.

I’ve spent the last few weeks researching how secure AI-built apps actually are once they hit production. So I took 100 publicly launched apps built with Lovable, Bolt, Cursor and similar tools (Product Hunt launches, showcase pages, “I built X” posts) and ran passive, read-only checks. I only looked at what any visitor’s browser already downloads: no logins, no attacks, no touching anyone’s data. I’m not naming any apps. What I found: 37/100 had at least one potentially exposed secret in

五维评分

付费意愿

需求真实度

个人可落地

竞争空间

新鲜度

AI 分析

痛点：AI 生成的 Web 应用普遍在前端泄露密钥、缺少安全头、暴露敏感文件，开发者缺乏低门槛的自动安全检查与修复工具。

目标用户：使用 Lovable、Bolt、Cursor 等 AI 工具快速上线应用的独立开发者、小型团队和非技术创始人。

证据：37/100 had at least one potentially exposed secret in their frontend JS. The most concerning patterns involved OpenAI, Stripe and Supabase credentials. ... Only 9/100 had no findings within the scope of these checks.

变现：免费扫描引流，付费提供持续监控、自动修复 PR、一次性深度审计或安全合规报告；可用 $10-30/月订阅或按项目收费。

MVP：2周内做一个只读扫描器：用户输入 URL，抓取公开 JS 和响应头，检测 VITE_/NEXT_PUBLIC_ 泄露的 sk_、Stripe、Supabase key，检查 CSP/HSTS/X-Frame-Options、/.git/、/.env.bak、CORS 通配符，输出风险报告和修复建议。

竞品：GitHub secret scanning、TruffleHog、Gitleaks、Snyk、Detectify、Aikido Security

摘要：作者对 100 个用 Lovable、Bolt、Cursor 等 AI 工具搭建并公开上线的应用做被动安全检查，发现 37 个前端 JS 暴露密钥（OpenAI、Stripe、Supabase），78 个缺少安全头，12 个暴露 /.git/ 或 .env.bak，只有 9 个无问题。问题多源于 VITE_/NEXT_PUBLIC_ 前缀误把服务端密钥打包到客户端。这为面向 AI 建站人群的自动化安全扫描/修复工具提供了明确切入点。