Key Takeaways
- The tool is rarely the problem: With AI you can build very secure and very insecure applications. What matters is who uses the tool.
- AI makes different mistakes: Human developers make mistakes too. AI removes old sources of error and introduces new ones.
- Another level of abstraction: In programming, AI is the next step after punch cards, assembler and high-level languages, and it raises productivity.
- Development is more than coding: Requirements, architecture, security and documentation remain human tasks. AI takes over writing the code.
- Security by design from day one: If you give the AI frameworks such as the OWASP Top 10, GDPR, NIS 2 or the Cyber Resilience Act, you get more secure code.
- A clear process protects you: Set up the project in Claude Code first, use Lovable only as one building block, version the code on GitHub and run it on a hardened server in Germany.
Introduction
This week a story even made it into the general press: programs built with Lovable are said to be a security risk. Lovable is a tool from Sweden. You write a prompt such as "build me a CRM system", and it builds a working application for you. Sounds too good to be true? That is exactly what this episode is about.
I am currently building a CRM system for a client, partly with Lovable. Using this example I want to show you that AI works like any other tool. You can build very secure solutions with it, or very insecure ones. The machine is rarely the real problem. The problem is usually the person who uses it without a plan.
The Lovable Headline Follows an Old Pattern
The headline basically says: AI builds insecure software. That reminds me of an old debate. For years people said iOS was always secure and Android always insecure. Neither is true in that form.
An iPhone can be compromised too, and Android devices can be secured properly with mobile device management. It is the same with AI in software development. If you know what you are doing, you build secure software with AI support. If you do not, it becomes dangerous, with or without AI.
Humans Make Mistakes Too, Just Different Ones
When we say AI makes mistakes in software development, especially in security, we often pretend that human developers make none. Of course that is not the case.
The comparison with self-driving cars makes this tangible. No human would drive into a white truck the way a Tesla once did. On the other hand, a human glances at their phone for a moment and rear-ends a motorcyclist, something a self-driving car usually does not do. Machines and humans make different mistakes. The question is not whether errors happen, but how you catch them.
AI Is the Next Level of Abstraction in Programming
In programming, AI is simply another level of abstraction. As a child I drew on punch cards in my father's office, very close to the hardware. When assembler and compilers arrived, many programmers complained that they no longer knew what the machine was doing. Every new level brought new errors, but also automatic corrections: a missing bracket is caught by modern tools today. With AI it is the same. New sources of error appear, old ones disappear, and overall productivity rises significantly.
Developing Software Is More Than Writing Code
What does AI actually replace in software development? Essentially the writing of code, and to some extent reviewing and refactoring it. Nothing more.
Does that make programmers redundant? Only if they see themselves as people who type lines of code. Real software development starts with requirements. For my client's CRM project we held several workshops with the sales team, collected requirements and turned them into a requirements specification and a functional specification. Then everything goes into an architecture document, and security is considered from the very beginning, not shortly before launch.
Security by Design: Give the AI the Rules
The good news is that proven security frameworks exist, and you can hand them directly to an AI. That is why I never set up a project in Lovable alone. Before I start there, I set up the project in Claude Code, using a standard routine.
The first principle is security by design. I specify, for example: always take the OWASP Top 10 2025 into account. OWASP is a non-profit open-source organisation that analyses the most common vulnerabilities in web applications and describes how to fix them. A concrete example: an application with a login needs a lockout after several failed attempts. Otherwise an attacker can try every password variant with a brute-force or dictionary attack. In the same way you can specify GDPR, NIS 2, DORA and the Cyber Resilience Act from the start.
The second principle is clean documentation of every step. Few programmers love documentation, yet good documentation is like a love letter to the next developer, and it helps to review the code.
A Fool with AI Makes the Disaster Faster
An old saying goes: a fool with a tool is still a fool. In the age of AI I put it this way: a fool with AI makes the disaster faster. Giving Lovable to someone who has never programmed and never dealt with IT security risks serious damage. Lovable has its own security checks, and they are improving, but they are no substitute for a sound process.
My approach: I build the framework in Claude Code first. Claude then generates the prompts for Lovable, and I review the result. The code is versioned on GitHub. One advantage of Lovable is that there is no lock-in; you can access your code at any time. Nothing runs productively on Lovable itself. The application goes onto a hardened Linux server at Hetzner in Germany, test and production environments are strictly separated, and every release gets a thorough security review.
Done this way, AI can even give you more secure software than writing it by hand.
Mentioned Tools & Resources
- Lovable: AI tool from Sweden that builds working web applications from prompts, with full access to your own code.
- Claude Code: Anthropic's AI development environment, which I use to set up projects, rules and prompts for Lovable.
- OWASP Top 10: List of the most common web application security risks published by the non-profit OWASP, usable as a rule set for AI.
- BMAD method: Framework for AI-assisted software development with agents for requirements, product documents, architecture and user interface.
- GitHub: Microsoft's platform for versioning code.
- Hetzner: German hosting provider where the applications run on hardened Linux servers.
Frequently Asked Questions
Is software built with Lovable insecure?
Not in principle. Lovable can produce secure and insecure applications. What matters is whether requirements, architecture and security rules are defined beforehand and the results are reviewed.
Do AI coding tools make more mistakes than human developers?
Mainly different ones. Human developers overlook security gaps too. AI reliably catches some old errors such as syntax mistakes and introduces new sources of error that a good process has to catch.
How do I make sure AI writes secure code?
Give the AI security by design from the start, for example the OWASP Top 10 2025, GDPR, NIS 2, DORA or the Cyber Resilience Act. Document every step, separate test and production and run a security review before every release.
What are the OWASP Top 10?
A list of the most common security risks for web applications, published by the non-profit open-source organisation OWASP. It also describes how to avoid them, for example with a lockout after several failed login attempts.
Will AI make programmers redundant?
Only those who see themselves purely as code writers. AI mainly replaces writing and refactoring code. Gathering requirements, designing architecture, planning security and reviewing results remain human tasks.
Is a custom CRM built with AI worthwhile for mid-sized companies?
For companies with roughly 20 to 400 employees it can be a very good option, provided there is a clean process with requirement workshops, specifications, an architecture document and a security review.
Conclusion
Software built with AI is not automatically insecure. It becomes insecure when nobody thinks through requirements, architecture and security. Give the AI rules such as the OWASP Top 10 from the start, document every step, separate test and production and review before every release. For mid-sized companies with about 20 to 400 employees, a custom CRM built with AI can be a very good option. I have been programming since my first C64 more than 40 years ago and have introduced CRM systems in many companies. If you would like support, feel free to get in touch. We work at fixed prices.
