Can Augment Code apps be hacked?

Augment Code-Specific Attack Vectors

These are the paths attackers actually take into Augment Code applications — not a generic OWASP list, but what automated scanners and security researchers find when they look at Augment Code apps specifically, given the stack (Supabase (Postgres + RLS) as the database):

1. **Bypassed Security Middleware**: AI-generated routes may skip the auth middleware pattern your team uses.

2. **Inherited Insecure Patterns**: Augment learns from your codebase — if there are insecure patterns, it propagates them.

3. **Supply Chain Risk from AI Suggestions**: Suggested dependencies may have known vulnerabilities.

4. **Business Logic Exposure**: AI has access to sensitive enterprise code during generation.

**Supabase-Specific Risk**: Augment Code apps typically ship with the public Supabase anon key embedded in frontend code. That is by design — but only works safely if Row Level Security is enabled on every table. Attackers routinely query Supabase endpoints directly using the anon key from your bundle. A single table without RLS is a full data leak.

How these issues get discovered

This isn't targeted — automated scanners run across the entire internet looking for known patterns, and Augment Code apps surface like everything else. Supabase URLs follow a predictable pattern (`*.supabase.co`), making Augment Code apps easy to fingerprint. Once identified, the scanner probes the specific vulnerability classes listed above.

What a security scan of a Augment Code app looks at

• **Middleware Compliance** — Verify AI-generated routes follow security middleware patterns.
• **Dependency Audit** — Check all AI-suggested packages for vulnerabilities.
• **Pattern Consistency** — Ensure generated code follows established security patterns.
• **Data Access** — Verify authorization on all new endpoints.