Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.
A large-scale scan of over 380,000 vibe-coded applications revealed widespread exposure of sensitive corporate and personal data. Approximately 40% of these apps exposed sensitive information, with thousands lacking any authentication. Common security issues include hardcoded secrets in client bundles, missing row-level security policies (notably in Supabase), improper authorization checks, exposed debug and admin routes, and overly permissive CORS settings. These vulnerabilities stem largely from shipping applications without proper security reviews rather than the vibe coding approach itself.
AI Analysis
Technical Summary
Researchers from Red Access scanned more than 380,000 public vibe-coded applications hosted on platforms like Lovable, Replit, Base44, and Netlify. They found that roughly 40% exposed sensitive data, with many lacking any authentication mechanisms. Key recurring vulnerabilities include secrets embedded in client-side code, missing row-level security policies especially in Supabase (linked to CVE-2025-48757), improper authorization allowing data access beyond logged-in users, leftover debug/admin endpoints, and CORS configurations set to allow all origins. The root cause is identified as insufficient security validation before deployment rather than inherent flaws in vibe coding or AI-generated code. Veracode's related study also found 45% of AI-generated code contains at least one OWASP Top 10 vulnerability.
Potential Impact
The exposed sensitive data can lead to unauthorized access to corporate and personal information. Missing authentication and authorization controls allow attackers to access or manipulate data they should not have access to. Hardcoded secrets in client bundles enable attackers to misuse third-party services. Open debug and admin routes increase attack surface. Overly permissive CORS settings can facilitate cross-origin attacks. The lack of row-level security policies in Supabase databases can lead to broad data exposure. These issues collectively increase the risk of data breaches and unauthorized data manipulation.
Mitigation Recommendations
This issue is not due to vibe coding itself but due to lack of security checks before deployment. Developers should audit their applications for exposed secrets in client code, enforce row-level security policies especially in Supabase, implement proper authorization checks beyond authentication, remove debug and admin routes before production, and configure CORS policies restrictively. For Supabase users, immediate review and correction of row-level security policies is critical. No official patch applies as these are configuration and development practice issues. Regular security reviews and testing before shipping applications are recommended.
Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.
Description
A large-scale scan of over 380,000 vibe-coded applications revealed widespread exposure of sensitive corporate and personal data. Approximately 40% of these apps exposed sensitive information, with thousands lacking any authentication. Common security issues include hardcoded secrets in client bundles, missing row-level security policies (notably in Supabase), improper authorization checks, exposed debug and admin routes, and overly permissive CORS settings. These vulnerabilities stem largely from shipping applications without proper security reviews rather than the vibe coding approach itself.
Reddit Discussion
Saw this study covered in Wired back in May and it's been living rent-free in my head since.
Red Access scanned 380,000+ public assets on Lovable, Replit, Base44, and Netlify. Roughly 40% were exposing sensitive data. Thousands had no authentication at all, not weak auth, none.
Veracode ran a separate study and found 45% of AI generated code carries at least one OWASP Top 10 vulnerability.
The part that got me is that these aren't exotic bugs. It's the same five things over and over:
1. Secrets in the client bundle. You asked the AI to connect to Stripe. It hardcoded the key where the browser can read it. Anyone who opens devtools has it.
2. Missing row-level security. This is the big one on Supabase. Your table is readable by anyone with the anon key unless you write policies. The AI usually doesn't. There's an actual CVE for this pattern (CVE-2025-48757).
3. Auth vs authorization. You have login working. But /api/users/:id returns any user's data if you change the number. Logged in ≠ allowed.
4. Debug and admin routes left open. The AI adds /debug or /admin while building and nobody removes it.
5. CORS set to ***.** Usually because someone hit a CORS error and asked the AI to fix it. It did, by turning the check off.
Moltbook got its database popped in under three minutes after the creator posted that he hadn't written a single line of code. Not because he vibe coded, because nobody checked.
Vibe coding isn't the problem. Shipping without checking is. If you're on Supabase, go look at your RLS policies right now. That's the one that gets people.
RESOURCES:
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Researchers from Red Access scanned more than 380,000 public vibe-coded applications hosted on platforms like Lovable, Replit, Base44, and Netlify. They found that roughly 40% exposed sensitive data, with many lacking any authentication mechanisms. Key recurring vulnerabilities include secrets embedded in client-side code, missing row-level security policies especially in Supabase (linked to CVE-2025-48757), improper authorization allowing data access beyond logged-in users, leftover debug/admin endpoints, and CORS configurations set to allow all origins. The root cause is identified as insufficient security validation before deployment rather than inherent flaws in vibe coding or AI-generated code. Veracode's related study also found 45% of AI-generated code contains at least one OWASP Top 10 vulnerability.
Potential Impact
The exposed sensitive data can lead to unauthorized access to corporate and personal information. Missing authentication and authorization controls allow attackers to access or manipulate data they should not have access to. Hardcoded secrets in client bundles enable attackers to misuse third-party services. Open debug and admin routes increase attack surface. Overly permissive CORS settings can facilitate cross-origin attacks. The lack of row-level security policies in Supabase databases can lead to broad data exposure. These issues collectively increase the risk of data breaches and unauthorized data manipulation.
Mitigation Recommendations
This issue is not due to vibe coding itself but due to lack of security checks before deployment. Developers should audit their applications for exposed secrets in client code, enforce row-level security policies especially in Supabase, implement proper authorization checks beyond authentication, remove debug and admin routes before production, and configure CORS policies restrictively. For Supabase users, immediate review and correction of row-level security policies is critical. No official patch applies as these are configuration and development practice issues. Regular security reviews and testing before shipping applications are recommended.
Technical Details
- Source Type
- Subreddit
- blueteamsec+AskNetsec+Information_Security
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a630b939c2644c7f87938f9
Added to database: 07/24/2026, 06:52:03 UTC
Last enriched: 07/24/2026, 06:52:12 UTC
Last updated: 07/24/2026, 18:34:56 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.