Vibe Coding Security Risks
Vibe coding changed how software gets built. Cursor, Lovable, Bolt, v0, and Claude Code let anyone go from idea to deployed app in hours. But AI models optimize for working code, not secure code. The result: a generation of production apps with critical vulnerabilities that would never pass a traditional security review.
We ran security audits across 17 of our own production apps, all built with AI coding tools. The findings were consistent: 60% had exposed API keys in client bundles, 80% had no rate limiting, and nearly every Supabase app had RLS policies that could be bypassed with the public anon key. These are not edge cases. They are the default output of AI code generation.
This guide covers the specific risks by tool, the 3-tier vulnerability model we developed, and how to fix the issues that actually matter.
The numbers are worse than you think
60% of AI-built apps ship with exposed API keys. 80% have no rate limiting. Nearly 100% of Supabase apps generated by AI tools have at least one RLS policy that grants broader access than intended.
Security risks by tool
Exposed Supabase keys, missing RLS, open signup allowing admin account creation
Missing CSP, exposed GraphQL with introspection, no rate limiting on any endpoint
Hardcoded secrets in components, client-side-only auth, SQL string concatenation
Unprotected Server Actions, missing middleware auth, client-side data fetching
CVE-2025-29927 middleware bypass, NEXT_PUBLIC env leaks, source maps in production
RLS USING(true) bypass, missing WITH CHECK on UPDATE, open storage buckets
No signup • Results in 3 minutes
The 3-tier hackability model
Not all security findings are equal. A missing X-Frame-Options header on a marketing page is not the same as an exposed service_role key. VibeArmor classifies every finding into one of three tiers so you know what to fix first.
Critical exploits
Proves someone can steal data right now. Exposed secrets, auth bypass, injection, cross-user data access. Heaviest score penalty.
Active defenses
Missing protections that enable real attacks. HTTPS, CSP, rate limiting, cookie flags. Moderate score penalty.
Best practices
Informational only. Shown in the report but never affects your letter grade. These are trivia, not threats.