Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.

0
Medium
Published: 07/24/2026 (07/24/2026, 06:31:53 UTC)
Source: Reddit BlueTeam

Description

A large-scale scan of over 380,000 vibe-coded applications revealed widespread exposure of sensitive corporate and personal data. Approximately 40% of these apps exposed sensitive information, with thousands lacking any authentication. Common security issues include hardcoded secrets in client bundles, missing row-level security policies (notably in Supabase), improper authorization checks, exposed debug and admin routes, and overly permissive CORS settings. These vulnerabilities stem largely from shipping applications without proper security reviews rather than the vibe coding approach itself.

Reddit Discussion

r/Information_Security·posted by u/UltimateScripted
00

Saw this study covered in Wired back in May and it's been living rent-free in my head since.

Red Access scanned 380,000+ public assets on Lovable, Replit, Base44, and Netlify. Roughly 40% were exposing sensitive data. Thousands had no authentication at all, not weak auth, none.

Veracode ran a separate study and found 45% of AI generated code carries at least one OWASP Top 10 vulnerability.

The part that got me is that these aren't exotic bugs. It's the same five things over and over:

1. Secrets in the client bundle. You asked the AI to connect to Stripe. It hardcoded the key where the browser can read it. Anyone who opens devtools has it.

2. Missing row-level security. This is the big one on Supabase. Your table is readable by anyone with the anon key unless you write policies. The AI usually doesn't. There's an actual CVE for this pattern (CVE-2025-48757).

3. Auth vs authorization. You have login working. But /api/users/:id returns any user's data if you change the number. Logged in ≠ allowed.

4. Debug and admin routes left open. The AI adds /debug or /admin while building and nobody removes it.

5. CORS set to ***.** Usually because someone hit a CORS error and asked the AI to fix it. It did, by turning the check off.

Moltbook got its database popped in under three minutes after the creator posted that he hadn't written a single line of code. Not because he vibe coded, because nobody checked.

Vibe coding isn't the problem. Shipping without checking is. If you're on Supabase, go look at your RLS policies right now. That's the one that gets people.

RESOURCES:

https://securityboulevard.com/2026/05/thousands-of-vibe-coded-apps-exposing-corporate-personal-data-redaccess/

https://yro.slashdot.org/story/26/05/08/1731257/thousands-of-vibe-coded-apps-expose-corporate-and-personal-data-on-the-open-web

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/24/2026, 06:52:12 UTC

Technical Analysis

Researchers from Red Access scanned more than 380,000 public vibe-coded applications hosted on platforms like Lovable, Replit, Base44, and Netlify. They found that roughly 40% exposed sensitive data, with many lacking any authentication mechanisms. Key recurring vulnerabilities include secrets embedded in client-side code, missing row-level security policies especially in Supabase (linked to CVE-2025-48757), improper authorization allowing data access beyond logged-in users, leftover debug/admin endpoints, and CORS configurations set to allow all origins. The root cause is identified as insufficient security validation before deployment rather than inherent flaws in vibe coding or AI-generated code. Veracode's related study also found 45% of AI-generated code contains at least one OWASP Top 10 vulnerability.

Potential Impact

The exposed sensitive data can lead to unauthorized access to corporate and personal information. Missing authentication and authorization controls allow attackers to access or manipulate data they should not have access to. Hardcoded secrets in client bundles enable attackers to misuse third-party services. Open debug and admin routes increase attack surface. Overly permissive CORS settings can facilitate cross-origin attacks. The lack of row-level security policies in Supabase databases can lead to broad data exposure. These issues collectively increase the risk of data breaches and unauthorized data manipulation.

Mitigation Recommendations

This issue is not due to vibe coding itself but due to lack of security checks before deployment. Developers should audit their applications for exposed secrets in client code, enforce row-level security policies especially in Supabase, implement proper authorization checks beyond authentication, remove debug and admin routes before production, and configure CORS policies restrictively. For Supabase users, immediate review and correction of row-level security policies is critical. No official patch applies as these are configuration and development practice issues. Regular security reviews and testing before shipping applications are recommended.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Source Type
reddit
Subreddit
blueteamsec+AskNetsec+Information_Security
Reddit Score
0
Discussion Level
minimal
Content Source
reddit_link_post
Post Type
link
Domain
null
Newsworthiness Assessment
{"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
Has External Source
true
Trusted Domain
false

Threat ID: 6a630b939c2644c7f87938f9

Added to database: 07/24/2026, 06:52:03 UTC

Last enriched: 07/24/2026, 06:52:12 UTC

Last updated: 07/24/2026, 18:34:56 UTC

Views: 12

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses