v0 generates real Next.js on real Vercel infra. Here's the env var that leaks to the browser, the service role key, and the server action nobody checks.
Replit Agent builds fast in the browser. Here's the Repl visibility leak, the secret that syncs to prod on deploy, and the auth check Agent skips.
Bolt.new ships full-stack apps in minutes. Here's the RLS default and env-var trap its speed skips, plus a 90-second self-check.
A data report on 66 live apps built with Lovable, Bolt, Cursor, base44, and Tempo. 41% of the Supabase-backed apps had at least one table anyone could read with the public anon key. Methodology, findings, and a 60-second self-check.