I Reviewed a Dozen "Vibe-Coded" Apps This Year. Here's What Actually Breaks.

ZANISS SOFTWARES — Mon, 28 Sep 2026 05:26:05 +0000

Every developer has a version of this story now: a founder or PM hands you an app built entirely in Lovable, Bolt, or Replit Agent and asks you to "just clean it up before launch." Having done this a dozen-plus times in the last year, the failure patterns are remarkably consistent, and they're worth naming so you can check for them before you agree to a scope.

The most common issue by far is API keys and secrets sitting in client-side code — not because the model doesn't know better, but because the fastest path to "it works" is often to skip environment variable setup entirely. Second is authorization logic that checks authentication (are you logged in) but not authorization (should you specifically have access to this record), which shows up as classic IDOR vulnerabilities the moment you change an ID in a URL. Third is database rules — Postgres row-level security, Firebase rules, Supabase policies — left wide open because the default during rapid prototyping is permissive access.

The data backs up the anecdotes: independent testing has found that around 45% of AI-generated code fails basic OWASP Top-10 checks, and cross-site scripting shows up roughly 2.74x more often in AI-generated pull requests than in human-written ones. None of this is an argument against using AI coding tools — plenty of us reach for Cursor or Copilot daily, and adoption sits at roughly 84% of developers for good reason. It's an argument for treating AI-generated code the way you'd treat a contractor's first pull request: useful, often fast, but not something you merge to main without a real review pass.

If you're the developer being asked to "clean up" a vibe-coded app, the fastest useful first step is a targeted security pass — auth flows, secrets, and data access rules — before you touch architecture or performance. That triage alone tells you whether you're looking at a few days of hardening or a genuine rebuild. We put together a longer breakdown of the decision framework, the real numbers behind the productivity-vs-risk tradeoff, and 2026 India pricing for each remediation path in the original article on vibe coding vs. custom software development, if you want the full picture to bring back to whoever's asking you to ship this by Friday.

DEV Community: ZANISS SOFTWARES

I Reviewed a Dozen "Vibe-Coded" Apps This Year. Here's What Actually Breaks.