默认安全配置
Engineering principle that systems enable authentication and least privilege by default to prevent unintended exposure.
Security researchers scanned 159,041 Lovable-generated projects and found many exposing passports, private messages and other sensitive data without any login. The incident highlights systemic gaps in default security posture and data-permission design across AI low-code platforms, with non-technical builders most at risk.
Security firm Claroc found that nearly 95 percent of more than 37,000 web apps built with Grok were publicly accessible without login, exposing confidential SpaceXSI and X business documents, patient lab values, shift schedules, and plaintext passwords. The root causes are insecure default publishing settings, easily discoverable URLs, and flawed access controls in Grok-generated code, underscoring systemic default-security risks in AI-generated applications.