GPT-6 Astra Can Write Your Entire App in Minutes — But 85% of Those Apps Are Still Insecure

Give GPT-6 Astra a prompt and a few minutes, and it will hand you back a working app: pages, a database, a login flow, a checkout. That part works shockingly well now. What doesn't improve at the same pace is whether the app is safe to put in front of real users.

We audit apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and every other AI tool people are shipping with right now, including apps built with the newest frontier models. The pattern hasn't changed as the models got smarter. In our reviews, the large majority of AI-generated apps, on the order of 85%, still ship with at least one issue that would let a stranger read data that isn't theirs, log in as someone else, or skip payment entirely. That number isn't from a published study. It's what we keep finding, audit after audit.

Why smarter models don't fix this

GPT-6 Astra and its peers are trained to produce code that runs, passes the prompt's intent, and looks correct on the surface. None of those goals require the model to ask "who is allowed to call this?" A login page that logs you in is a success by that standard. A login page that logs you in as anyone whose email you happen to type is also, technically, a success by that standard.

Security isn't a feature you get more of by making the model better at writing code. It's a set of questions the model has to think to ask on its own, and most prompts never ask it to. "Build a dashboard where users see their orders" doesn't tell the model to check that the order actually belongs to the logged-in user. So it often doesn't.

The bug that shows up almost every time

The single most common issue we see is an API route that fetches a record by its ID with no ownership check. It's simple to write, simple to miss, and simple to exploit.

// Broken: returns any order if you know or guess the ID
app.get("/api/orders/:id", async (req, res) => {
  const order = await db.orders.findById(req.params.id);
  res.json(order);
});

Change the number in the URL, and you're looking at someone else's order. The fix is one line, but the model has no reason to write it unless you ask:

// Fixed: only returns the order if it belongs to the requester
app.get("/api/orders/:id", async (req, res) => {
  const order = await db.orders.findById(req.params.id);
  if (!order || order.userId !== req.user.id) {
    return res.status(404).json({ error: "Not found" });
  }
  res.json(order);
});

That's the whole difference between a normal API route and a data leak. We see variations of this in auth tokens signed with a placeholder secret, webhook handlers that never check a signature, and login forms with no limit on failed attempts. Every one of these is a single missing check, and every one of them is invisible while you're just clicking through the app checking that it works.

What to actually check before launch

Testing the app by using it tells you the happy path works. It tells you nothing about what happens when someone sends a request the UI was never built to send. That's the part a fast model doesn't protect you from, no matter how capable it is at generating the front end.

If you built something with GPT-6 Astra, Claude Code, Cursor, or any other AI tool and haven't had someone look past the interface, our free assessment checks exactly this: ownership checks on your API routes, auth secrets, webhook verification, and rate limiting. It takes a few minutes and tells you what to fix before a user, or an attacker, finds it first.

A fast build and a secure build are two different things. Right now, one AI model gets you the first one. You still have to go get the second.

VibeAudits audits apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and other AI tools.

FAQ

Is GPT-6 Astra safe to build an app with? It's safe in the sense that the code will usually run. It won't reliably enforce access control, verify webhooks, or rate-limit logins on its own. You still need to check those things separately, the same as with any AI coding tool.

Why don't newer, smarter AI models fix these security gaps? Because the model is optimized to produce code that matches your prompt and runs correctly, not code that has been checked against how an attacker would misuse it. Asking for "a dashboard" doesn't tell it to check who owns the data being shown.

What's the most common vulnerability in AI-generated apps? Missing ownership checks on API routes, often called IDOR (insecure direct object reference). An endpoint fetches a record by ID without confirming the logged-in user actually owns it.

How do I check if my AI-built app is secure before launch? Look specifically at authentication secrets, whether every API route checks ownership, whether payment webhooks verify their signature, and whether login and OTP forms limit repeated attempts. A free assessment from VibeAudits checks all of these in a few minutes.

Does this apply to apps built with tools other than GPT-6 Astra? Yes. The same gaps show up across Cursor, Lovable, Bolt, Claude Code, Replit, and every other AI coding tool we've audited. The model changes; the missing checks don't.