The 5 security flaws we find in almost every vibe-coded app

Your app works. Customers pay for it. And if it was built with Lovable, Bolt, Cursor or any AI assistant, there is a good chance it shares the same handful of security flaws as almost every app we scan. Veracode found security weaknesses in 45% of AI-generated code samples — and they are not where you would expect.

1. API keys shipped to the browser

AI assistants happily paste secret keys into frontend code. Anything in your JavaScript bundle is public: anyone can open developer tools and read your OpenAI, Stripe or database keys. Moltbook exposed 1.5 million API tokens exactly this way. Quick check: open your deployed site, view the page source, and search for "sk-" or "key".

2. A database open to anyone (missing RLS)

Supabase-backed apps rely on Row Level Security to decide who can read which rows. When RLS is missing or misconfigured — the case for roughly 10% of Lovable apps analyzed — any visitor with your public anon key can read your entire database: users, messages, payments.

3. Permissions that only exist in the UI

Hiding the admin button is not access control. If the API behind it accepts requests from anyone, an attacker does not need the button. This is the class of flaw growing fastest in AI-assisted code: Apiiro measured a 322% increase in privilege-escalation paths. It is also invisible in a demo — everything looks fine until someone hostile shows up.

4. No rate limiting anywhere

Login endpoints that accept unlimited attempts, and AI endpoints that anyone can hammer at your expense. One script, one night, and you get compromised accounts or a four-digit API bill.

5. Personal data lying around

Public storage buckets, API responses that return far more fields than the UI displays, emails and tokens in logs. Under GDPR this is not just a technical problem — it is a legal one. The Tea app leak, where private messages became publicly readable, started exactly like this.

None of this means your app is doomed

Every flaw above is fixable, almost always without rebuilding anything. The vibe coding got you a product and paying customers — that was the hard part. Securing it is a known, bounded job. Our free 48-hour scan checks all five of these on your app, and we tell you honestly what we find.