CampaignPublished 30 Oct 2025

How we found +2k vulns, 400+ secrets and 175 PII instances in publicly exposed apps built on vibe-coded platforms (Research methodology)

Source Reddit NetSec

Description

A security research campaign uncovered over 2,000 medium vulnerabilities, including 98 highly critical issues, across publicly exposed applications built on vibe-coded platforms integrating Lovable front-ends with Supabase backends. The research revealed 400+ exposed secrets and 175 instances of personally identifiable information (PII), including sensitive data such as bank details and medical information. Notable vulnerabilities include Broken Object Level Authorization (BOLA), Server-Side Request Forgery (SSRF), and zero-click account takeover exploits. The threat arises from the architectural integration where sensitive tokens and API keys are exposed in frontend bundles, increasing the attack surface. Although no known exploits are currently in the wild, the critical severity and volume of findings indicate a significant risk. European organizations using these platforms or similar architectures face risks of data breaches, unauthorized access, and service disruption. Mitigation requires targeted scanning for exposed secrets in frontend code, strict API authorization enforcement, and comprehensive secrets management. Countries with high adoption of Supabase and vibe-coded platforms, such as the UK, Germany, France, and the Netherlands, are most likely affected. Given the ease of exploitation and sensitive data exposure without authentication, the suggested severity is critical.

Impact

For European organizations, this threat poses significant risks including unauthorized data access, leakage of sensitive personal and financial information, and potential account takeovers. The exposure of secrets and tokens in frontend code can lead to compromised backend APIs, enabling attackers to manipulate or exfiltrate data. The presence of PII such as bank details and medical information raises compliance concerns under GDPR, potentially resulting in regulatory penalties and reputational damage. Exploitation of BOLA and SSRF vulnerabilities can lead to privilege escalation and lateral movement within networks, increasing the scope of compromise. The zero-click account takeover vulnerabilities further exacerbate risks by enabling attackers to compromise accounts without user interaction, complicating detection and response. Disruption of services and loss of data integrity are additional concerns, impacting business continuity. European organizations relying on these platforms must consider the threat critical due to the ease of exploitation and the sensitivity of exposed data.

Defensive guidance

Organizations should implement targeted scanning tools to detect exposed secrets and tokens within frontend bundles and source code repositories. Enforce strict API authorization policies, ensuring robust object-level access controls to prevent BOLA vulnerabilities. Adopt secure coding practices that avoid embedding sensitive tokens in frontend code; instead, use secure backend token management and short-lived credentials. Implement network-level protections and input validation to mitigate SSRF risks. Conduct thorough audits of third-party integrations and dependencies, particularly those involving Supabase and vibe-coded platforms. Employ secrets management solutions that automate rotation and prevent accidental exposure. Enhance monitoring and anomaly detection to identify unusual API usage patterns indicative of exploitation attempts. Educate developers on secure integration patterns and the risks of exposing backend credentials in frontend code. Finally, prepare incident response plans tailored to address potential data breaches involving PII and secrets exposure.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Oct 2025, 15:56 UTC

Technical details

References

Community reviews

Related threats