I scanned 54 public repos of AI-built apps. 1 in 5 had something worth fixing.

Nqspq — Fri, 31 Jul 2026 17:11:12 +0000

If you build with Lovable, Bolt or Replit, your code ends up in a repo you probably never open. So I scanned 54 of them — public repos, picked by "recently updated".

19% had something worth fixing. 15% had a password or an API key pasted straight into the code — one of them in a .tsx file, which means it ships to every visitor's browser. Two more were API keys sitting in SETUP.md, which is the sneakiest one: source files get checked, setup docs don't.

Honestly, at first my scanner got this wrong. It reported 4x more criticals than were real — a lone -----BEGIN PRIVATE KEY----- header counted as a leak, and every committed .env was "critical" even when it only held public Supabase values. Fixed both.

Two things worth checking in your own project:

Is your .env file in the repo? It starts with a dot, so it's invisible in most file browsers, and plenty of people assume it stays local. It doesn't — if it got committed, it's on GitHub for anyone to read. Run git ls-files | grep -i env in your project folder to find out.

Is your key actually secret? If a variable name starts with VITE_ or NEXT_PUBLIC_, the build tool deliberately bakes its value into the code sent to the browser. That's what the prefix is for. So VITE_OPENAI_API_KEY isn't hidden — any visitor can open devtools and read it.

Tool is free, no signup: defcod.vercel.app. Engine is MIT: github.com/Nqspq/defcod-engine

DEV Community: Nqspq

I scanned 54 public repos of AI-built apps. 1 in 5 had something worth fixing.