Home·Guides·API security for Lovable, Cursor, and v0 apps
API security for Lovable, Cursor, and v0 apps
Routelint·
Apps shipped from Lovable, Cursor, v0, and similar tools often expose JSON APIs from the browser before anyone writes a security suite or an OpenAPI file.
Those tools optimize for a working interface. Auth on every handler, peer isolation, and forgotten debug paths are easy to skip. The traffic that matters is already on the page: the XHR and fetch calls the UI makes after load and after login.
Routelint is built for that workflow. Prove you own the host, record a browser session against the running app, then replay each call anonymously and as a peer. Findings cover unguarded access, IDOR, secrets in responses, and sensitive paths such as /debug and /.env.
You do not need to export a Swagger document from the generator. If the app is behind login for the interesting routes, paste a bearer token for a login scan after the target is verified. Replays stay read-only by default.
Use a free site scan for one pass of counts and severities, or sign up to keep targets, identities, and redacted evidence. The SEO and GEO check is separate; it scores how a public marketing page reads to search and answer engines, not your API handlers.