Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
- Tried
- Lovable vs Bolt vs Cursor on one invoice-app spec (2026 study)
- Broke
- Lovable: missing RLS; Bolt: secrets in frontend bundle (sk_live_, DB URL); Cursor: BOLA on invoice routes
- Fix
- Tool-specific audits (RLS vs secrets vs API auth), not one generic checklist