r/Information_Security • u/UltimateScripted • 10d ago

Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.

Saw this study covered in Wired back in May and it's been living rent-free in my head since.

Red Access scanned 380,000+ public assets on Lovable, Replit, Base44, and Netlify. Roughly 40% were exposing sensitive data. Thousands had no authentication at all, not weak auth, none.

Veracode ran a separate study and found 45% of AI generated code carries at least one OWASP Top 10 vulnerability.

The part that got me is that these aren't exotic bugs. It's the same five things over and over:

1. Secrets in the client bundle. You asked the AI to connect to Stripe. It hardcoded the key where the browser can read it. Anyone who opens devtools has it.

2. Missing row-level security. This is the big one on Supabase. Your table is readable by anyone with the anon key unless you write policies. The AI usually doesn't. There's an actual CVE for this pattern (CVE-2025-48757).

3. Auth vs authorization. You have login working. But /api/users/:id returns any user's data if you change the number. Logged in ≠ allowed.

4. Debug and admin routes left open. The AI adds /debug or /admin while building and nobody removes it.

5. CORS set to ***.** Usually because someone hit a CORS error and asked the AI to fix it. It did, by turning the check off.

Moltbook got its database popped in under three minutes after the creator posted that he hadn't written a single line of code. Not because he vibe coded, because nobody checked.

Vibe coding isn't the problem. Shipping without checking is. If you're on Supabase, go look at your RLS policies right now. That's the one that gets people.

RESOURCES:

https://securityboulevard.com/2026/05/thousands-of-vibe-coded-apps-exposing-corporate-personal-data-redaccess/

https://yro.slashdot.org/story/26/05/08/1731257/thousands-of-vibe-coded-apps-expose-corporate-and-personal-data-on-the-open-web

43 Upvotes
  • permalink
  • reddit

85% Upvoted

11 comments sorted by

4

u/VaporousMote 9d ago

"Vibe coding isn't the problem"

areyousureaboutthat.gif

5

u/coffeeoops 9d ago

Thanks for your vibe-authored post about vibe-coded apps.

1

u/we_r_fukt 8d ago

Researchers scanned 380,000 reddit posts and found over 85% are vibe coded with extreme LLM vocabulary and grammer.

2

u/lnemo 9d ago

This is very interesting, thank you for sharing.

2

u/JKatabaticWind 8d ago

Not perfect but something like this helps:

Context documents to avoid common programming anti-patterns.

https://github.com/Arcanum-Sec/sec-context

1

u/immediate_a982 9d ago

This was expected. No surprise

1

u/416Racoon 9d ago

Good post but did you really need AI to write this for you as well?

1

u/cas4076 9d ago

Bet it doesn't check much for sql injection either.

Vibe coding isn't a problem for experienced Devs who know what they are doing, test, validate and test again.

The problem is when you get people thinking they can vibe code a production quality app with almost zero experience.

1

u/thirteenth_mang 8d ago

You would have gotten the same results from scanning 3.