I Audited 50 Vibe-Coded Apps. Here's What Broke.

Short summary

Security audit of 50 production AI-generated apps (Lovable, v0, Bolt, Cursor, Claude Code) found five critical vulnerabilities: Row Level Security disabled in 70%, secrets leaked via NEXT_PUBLIC_ variables in 78%, inverted auth checks, unscoped AI agent tokens with drop-database capability, and prompt injection via unsanitized input. Includes grep detection commands and concrete SQL/code fixes for each.

• •70% of audited apps had Supabase RLS disabled; NEXT_PUBLIC_ secrets exposed in 78%
• •Inverted auth logic, unscoped agent tokens, and direct prompt injection found across deployments
• •Each vulnerability includes detection commands (grep patterns) and fix code with real CVE references

Generated with AI, which can make mistakes.