The Vibe Coding Security Top 10 Gotchas: What Actually Broke in 2025–26

Companion piece: the FastLane / SpeedBump workshop guide — investigate a synthetic vibe-coded breach modeled on this exact pattern, then audit the same app before it ships. Free to run yourself, free 20-minute Lightning Lesson, and a paid live deep-dive on Maven.

---

Vibe coding, describing what you want and letting an AI agent generate the whole app, backend included has collapsed the cost of shipping software from weeks to an afternoon. It didn't collapse the cost of a security review. A generated app looks done: it renders, it logs users in, it talks to a database. Whether it's also readable and writable by a stranger with curl and five minutes is a separate question, and in a lot of real 2025–26 incidents, nobody asked it before the app went live.

We didn't have to guess at the pattern. It's already documented, named, and in several cases CVE-numbered. Here's the sourced version and, matching the standard we hold every workshop to (TollBooth/OpenDoor, Tailgate/GuestList), every claim below is real and linked, not rounded up for effect.

1. Row-Level Security, left off

The single most-corroborated finding on this list. CVE-2025-48757 covers 170 of 1,645 scanned Lovable-built apps shipping with Supabase Row-Level Security either disabled or misconfigured against the actual business logic, meaning the public anon key embedded in the client's own JavaScript was enough to read or write every row in the database directly, no login required. The Moltbook breach is the same root cause in the wild: a vibe-coded AI social network whose creator has said he "didn't write a single line of code" shipped without RLS, exposing 1.5 million API tokens and 35,000 email addresses until Wiz's researchers disclosed it. Neither app was attacked in some sophisticated way. Someone opened the network tab, found the key, and asked the database for everything.

2. Secrets, shipped in the bundle

Escape.tech's scan of 5,600 live vibe-coded apps found over 400 exposed secrets and 175 instances of exposed PII, API keys and access tokens sitting in client-side JavaScript that any visitor's browser already downloaded. This isn't unique to AI-generated code, but AI-assisted commits appear to make it worse: GitGuardian's State of Secrets Sprawl 2026 report put the secret-leak rate on Claude Code-assisted commits at 3.2%, more than double the 1.5% baseline across public GitHub and AI-service-related secret leaks specifically rose 81% year over year.

3. Slopsquatting

Researcher Seth Larson coined "slopsquatting" for a new twist on typosquatting: instead of registering a name close to a real package, an attacker registers the name an AI model hallucinates. The USENIX 2025 paper that first quantified it found roughly 1 in 5 AI-generated code samples recommended a package that doesn't exist. It's not theoretical, Lasso Security's Bar Lanyado registered an empty package under a name he'd watched models repeatedly hallucinate, and it picked up tens of thousands of real downloads over the following months, including getting copy-pasted into a real company's public README.

4. Authorization that only exists in the frontend

Broken Object-Level Authorization (BOLA/IDOR) is an old bug class; vibe coding makes it a common default because "check if this user owns this record" is exactly the kind of guard an agent will skip unless explicitly told to enforce it server-side. Apiiro's analysis of AI-assisted commits inside Fortune 50 engineering orgs, not startups, mature security teams found 322% more privilege-escalation paths in AI-generated code than human-written equivalents. Lovable's own bug bounty program sat on an open BOLA report for 48 days, a flaw that let any free account reach another user's private projects, source code, and database credentials in as few as five API calls — after closing an earlier duplicate report as "intended behavior."

5. Insecure defaults, shipped by the platform itself

Sometimes the gotcha isn't what the AI generated for your app, it's what the platform generated for every app. Base44's Wiz-disclosed authentication bypass let anyone create a verified account on someone else's private enterprise app using nothing but a publicly visible app_id , no password, no SSO challenge, because the platform's own registration endpoint trusted that value by default. Lovable, similarly, shipped with RLS off by default on generated projects until it changed that default after CVE-2025-48757.

6. The coding tools trust the folder you opened

The newest entry, and arguably the strangest: the vulnerability isn't in the app you're building, it's in the agent building it. "TrustFall" showed that Claude Code, Cursor, Gemini CLI, and Copilot CLI would all auto-trust a project's MCP configuration on open, meaning a cloned repo with the right two JSON files could get code execution with a single accepted prompt, or none at all in a headless CI run. Separately, CVE-2026-12537 — a maximum-severity 10.0 CVSS finding in Gemini CLI , let a crafted .gemini/.env file achieve host-level code execution on headless CI platforms before the sandbox even engaged. Both are fixed now. Both existed because the tools optimized for a smooth first-run experience over a suspicious one.

7–9. CORS wildcards, leaked env vars, and forgotten debug routes

Three more patterns that show up constantly in vibe-coded apps, at varying levels of evidence strength and we're not going to round any of them up past what's actually documented. Overly permissive CORS (Access-Control-Allow-Origin: *) appears to be a repeated default in at least one popular AI coding tool's generated output, but the evidence here is a single detailed technical writeup, not a large-sample study, treat it as a real, common pattern, not a quantified one. Leaked environment variables tied to these platforms show up throughout GitGuardian's broader secret-leak data, compounded by platforms like Replit defaulting new projects to public. Exposed admin/debug routes left over from scaffolding are widely and plausibly reported anecdotally, but the strongest supporting numbers we found trace back to unverifiable marketing content, so this one stays a "watch for it," not a cited statistic.

10. The baseline is already bad

Zoom out from vibe coding specifically, and the ground floor isn't solid either. Veracode tested over 100 LLMs against 80 security-relevant coding tasks and found 45% of AI-generated code samples contained a detectable OWASP Top 10 flaw regardless of how large the model was. This is the least vibe-coding-specific item on this list, it applies to any AI-assisted code, written by a professional engineer or generated end-to-end from a prompt, but it's also the most rigorously quantified stat here, and it's the floor everything above gets built on top of.

The five-minute check that would have caught most of this

Every one of the top three items on this list — RLS, secrets, and broken authorization is checkable from outside the app, with no special access:

# Does the public anon/client key let you read tables it shouldn't?
curl -s "https://<project>.supabase.co/rest/v1/<table>?select=*" \
  -H "apikey: <the key shipped in your own JS bundle>" | head -c 300

# Is a secret sitting in plain sight in the shipped bundle?
curl -s https://your-app.example.com/_next/static/chunks/*.js \
  | grep -oE '(sk-|service_role|AKIA)[A-Za-z0-9_-]{10,}'

If either of those returns something it shouldn't, you've found the same class of bug that hit Lovable, Moltbook, and Base44 — before an attacker does. That's the entire premise of FastLane (investigate a breach built on this exact pattern) and SpeedBump (audit for it before shipping): the checks aren't exotic, they just have to actually happen.

Run it yourself

The full workshop, both scenarios, real evidence modeled on the incidents above, and a printed setup guide is free at casky-ai.github.io/casky-workshops/fastlane.html. Same free/open-source-always model as every workshop we run: the content never has a paywall. If you'd rather go deeper live, there's a free 20-minute Lightning Lesson (link on the workshop page — date not final yet) and a full paid session on Maven for teams who want to go deeper.