Security research for vibe-coded apps
Deep dives and data on the vulnerabilities that show up most often in apps built with Cursor, Bolt, Lovable, and v0. For step-by-step fixes, see the guides.
Vibe Coding Security Statistics 2026: What the Data Actually Shows
Every credible number circulating about AI-generated app security, in one place — flaw rates, breach counts, CVE volume, and what they mean for you.
Read the postCORS Misconfiguration in AI-Generated Code
Why Cursor, Bolt, and Lovable keep shipping wildcard CORS origins by default — and the exact escalation pattern that turns it into a real vulnerability.
Read the postFirebase Security Rules Misconfiguration in Vibe-Coded Apps
Your Firebase API key being public is normal. Permissive security rules behind it are how attackers read your entire database.
Read the postJWT and Session Security Mistakes in AI-Generated Auth Code
Tokens that never expire, live in localStorage, and never get verified server-side — the auth shortcuts AI coding tools take by default.
Read the postExposed Source Maps in Production
What an attacker actually sees when your production .js.map files are publicly reachable — and the one config flag most AI scaffolds never set.
Read the post