I started noticing the same security mistakes on every vibe-coded app I looked at. So I scanned 100 of them. Here's what came up.
94 out of 100 had at least one critical issue.
The most common findings:
78 sites — Supabase RLS disabled. Any user can query your entire database directly. Customer emails, orders, everything. The fix takes 2 minutes but nobody told them it was off.
61 sites — API keys in the JS bundle. If you prefix a variable with VITE_, it ends up in your compiled JavaScript. Completely public. This is how people wake up to a $3,000 OpenAI bill.
89 sites — no privacy policy. GDPR fines start at €10,000. Doesn't matter how small your startup is.
73 sites — no rate limiting on auth endpoints. Open to brute force.
The common thread: none of these founders knew. The AI tools just ship and move on.
I built vibelegit.io to catch this automatically — real HTTP requests to your live site, not just a code read. Every finding comes with an AI fix prompt you can paste into Cursor or Lovable.
If you've shipped something with an AI coding tool, worth running a scan before someone else does.
Top comments (0)