← Home
Report April 2026 · Updated live

State of Vibe-Coded Security

We scanned 13,244 deployed apps built with AI coding tools. Here's what's leaking — and what's not.

13,244
Apps scanned
2704
Critical findings
11,866
High findings
257,793
Total findings

Is your app vulnerable?

Paste your URL — quick results in 10 seconds, no signup.

The headline number

7% of Lovable and Bolt apps have databases anyone can read. YC-backed companies, scanned as a control group: 0%. The tools share the same backend (Supabase), the same framework (React), the same deployment pipeline. The difference is what the developer knows — and what the AI code generator assumes.

Per-platform CRIT rate

PlatformScannedWith CRITRate
YC companies (W21–F25)20000%
Lovable476347.1%
Bolt.host289217.3%
Replit19442.1%
Vercel (v0/AI)6723.0%
Streamlit9000%
Other (Heroku, Render, Fly, Netlify)5335.7%

Real cases — real people affected

CRITICAL

Therapist coaching site — 15 tables exposed

Payment methods, future session schedules, subscriber lists, and email delivery logs for paying therapy clients. Built with Lovable.

CRITICAL

Booking platform — 43 tables including customer chat logs

Every customer record, booking request, chat message, and uploaded file. The largest single exposure we found.

CRITICAL

Health booking app — patient data via URL manipulation

Change /api/bookings/1 to /api/bookings/2 — returns another patient's name, phone, email, and appointment. No auth check. Built with Replit.

CRITICAL

CRM with 22 tables — companies, contacts, customers, partners

An entire business CRM's data readable by anyone with the public anon key. Accounting references, lead sources, manager assignments. Built with Lovable.

CRITICAL

College student management — enrollment records exposed

Batch student data, profiles, subjects, and support tickets for an Indian engineering college. Protected under India's DPDP Act.

5 finding categories beyond Supabase RLS

Get the full scan on your app

80+ modules: Supabase RLS deep probe, XSS, IDOR, API key detection, Firebase audit, AI code fingerprinting, OWASP compliance report, and more.

Sign up free — no card Try quick scan

Methodology

Targets sourced from certificate transparency logs, Google search, and platform directories. All scans are read-only (GET + minimal POST probes). 80+ scanner modules per target. Every CRIT finding verified reproducible before disclosure. Private disclosures sent to all identifiable owners before publication.

What we scan for

Supabase RLS · Firebase rules · XSS · IDOR · CORS · CSP bypass · Cookie security · GraphQL mutations · WebSocket auth · Open redirect · DNS zone transfer · API key exposure (38 patterns) · JS prototype pollution · Dependency confusion · AI code fingerprinting · LLM hallucination detection · OAuth redirect · JWT weak secrets · Subdomain takeover · Nuclei CVE templates · and more.

Full module-by-module walkthrough →

Detailed write-ups

Get the next report

One email when we publish the next batch scan. No marketing.

This report pulls live data from our scanner database. Questions, corrections, or press inquiries: [email protected].