I scanned 100 sites built with Lovable, Cursor and Bolt. Here's what I found.

necati — Wed, 24 Jun 2026 20:40:06 +0000

I started noticing the same security mistakes on every vibe-coded app I looked at. So I scanned 100 of them. Here's what came up.
94 out of 100 had at least one critical issue.
The most common findings:

78 sites — Supabase RLS disabled. Any user can query your entire database directly. Customer emails, orders, everything. The fix takes 2 minutes but nobody told them it was off.

61 sites — API keys in the JS bundle. If you prefix a variable with VITE_, it ends up in your compiled JavaScript. Completely public. This is how people wake up to a $3,000 OpenAI bill.

89 sites — no privacy policy. GDPR fines start at €10,000. Doesn't matter how small your startup is.

73 sites — no rate limiting on auth endpoints. Open to brute force.
The common thread: none of these founders knew. The AI tools just ship and move on.

I built vibelegit.io to catch this automatically — real HTTP requests to your live site, not just a code read. Every finding comes with an AI fix prompt you can paste into Cursor or Lovable.
If you've shipped something with an AI coding tool, worth running a scan before someone else does.

vibelegit.io

DEV Community: necati

I scanned 100 sites built with Lovable, Cursor and Bolt. Here's what I found.