The same five problems keep appearing. Across every vibecoded project that comes through Audit Vibe Coding, our tool that scores AI-generated apps on security, SEO, performance, accessibility and code quality, certain issues recur so predictably that we started tracking them.
We build AI products at Inithouse, a software studio with 17 live apps. Most of them were scaffolded with AI tools. So when we built an audit specifically for vibecoded projects, we had a head start: we'd already found these problems in our own code.
Here is what keeps showing up.
Client-side secrets sitting in plain sight
This one is almost universal. The AI generates a Supabase or Firebase integration, drops the anon key into a .env file or, worse, directly into the source code. The key ships to the browser. Anyone with DevTools can read it.
The anon key itself is not catastrophic if Row Level Security is configured correctly. But in most vibecoded projects, it is not configured, because the AI did not set it up and the builder did not know to ask. We have seen projects where the service_role key (full database access) was exposed the same way. One grep through the built JavaScript and it is there.
Every page returns the same HTML title and meta description
This is the canonical SPA rendering bug, and it is the most common SEO issue in vibecoded apps by a wide margin. The AI scaffolds a React single-page application. The router handles page transitions in the browser. But when Google or an AI crawler requests a URL, the server returns the same base HTML shell for every page: same <title>, same meta description, same canonical tag pointing to the homepage.
A project with fifty content pages shows up in Google's index as fifty near-duplicates of the homepage. We have seen crawl reports where 70-80% of pages were flagged as "crawled, currently not indexed" for exactly this reason.
No error boundaries anywhere
When a vibecoded React component throws an error, the entire app goes white. No fallback UI, no error message, no recovery path. The AI rarely generates error boundaries unless you specifically ask for them. The result is a fragile app where a single failed API call or a missing data field crashes the whole page. Users see a blank screen and leave.
In the audit, this shows up as a code quality issue, but it has direct performance and retention implications.
Forms that pass input straight through
AI-generated forms tend to collect data and send it directly to the database or API endpoint without validation or sanitization on either end. No length limits, no type checking on the server, no rate limiting on the endpoint. We have audited projects where the contact form could submit the same message hundreds of times per minute because there was no throttle.
In a vibecoded app, the backend is usually a few Supabase edge functions or serverless routes. The AI writes them to work, not to be safe.
Images served at full resolution without optimization
The AI drops in an <img> tag with the source URL. No srcset, no lazy loading, no width/height attributes, no WebP or AVIF conversion. On mobile connections, a single hero image can add three to five seconds to the initial load. We score this under performance, but it compounds: poor Core Web Vitals hurt SEO rankings, which reduces traffic, which makes paid acquisition more expensive.
The fix is mechanical (a single image optimization pass), but it is missed in nearly every vibecoded project we look at because the AI was not prompted for it.
Why these particular issues keep recurring
The pattern is always the same. The AI generates code that works in the happy path. The builder tests it locally, sees it function, and ships. The issues we flag are not bugs in the traditional sense. The app runs, the pages load, the forms submit. They are gaps between "it works" and "it is production-ready."
Security configuration, server-side rendering, error handling, input validation, asset optimization: these are not features the AI adds unprompted. They are the work that happens after the scaffolding is done, and in a vibecoded workflow, that layer is often skipped entirely.
That is the gap Audit Vibe Coding is designed to catch. We score each project across the five categories, flag the specific issues, and return prioritized fixes so the builder knows what to address first and what can wait. The tool exists because we needed it ourselves. We run the same audit on every product in the Inithouse portfolio before anything ships.
If you are building with AI tools and have not audited the output, the issues above are a reasonable place to start looking.
Top comments (0)