I recently audited 549 public "vibecoded" repos (577 candidates, 28 excluded for size/availability), using a deterministic rules engine, no LLM in the analysis loop. Per-repo results published as anonymised JSONL so all figures are independently recomputable.

Interesting to me so thought I'd share.

Headline results (full corpus / substantive subset of repos with 15+ scannable files, n=467):

- Committed secrets: 20.4% / 23.3%

- >1 critical or high finding: 26.8% / 30.2%

- >1 critical finding: 14.9% (full corpus)

- Injection-category findings: 47.5% / 48.8%

- dangerouslySetInnerHTML usage: 42.6% / 43.0% (most common single finding)

- .gitignore missing .env: 35.7%

- Wildcard CORS: 11.3% · curl|sh install instructions: 9.8%

- Hardcoded passwords: 9.3%

Some observations: the finding classes are dominated by process gaps over vulnerability patterns. The rate of committed secrets correlate with the .gitignore issues. The injection and innerHTML classes are the standard sanitisation story. Nothing agent-specific in the remediation, only in the frequency.

Full report, methodology, and raw data: https://ogbuilds.ai/studies/vibe-coded-security

Disclosure: the rules engine is a scanner I built; the study and data carry no signup or paywall. Let me know what you think, happy to answer any questions!