Security research for vibe-coded apps
Deep dives and data on the vulnerabilities that show up most often in apps built with Cursor, Bolt, Lovable, and v0. For step-by-step fixes, see the guides.
SEO, AEO, and GEO: The Check Almost Every Vibe-Coded App Fails
Across 141 real scans, the most commonly missing item isn't a meta tag — it's FAQ schema, the one thing that lets AI answer engines quote you at all.
Read the postBroken Access Control: The #1 Vibe-Coding Vulnerability
Why broken access control — not leaked keys or weak passwords — is the leading cause behind public vibe-coding breaches like the Tea app and Moltbook incidents.
Read the postAI-Generated Code and XSS: An Old Bug, Back at Scale
XSS shows up in the majority of AI-generated code samples tested across major LLMs — including a newer form appearing wherever apps render AI chat output directly into the page.
Read the postPrompt Injection: Securing the AI Feature You Shipped
System prompt leakage, injected instructions, and unmetered model API access — the AI-specific attack surface most security checklists still miss.
Read the postExposed Storage Buckets and Secrets: The Shadow AI Crisis
Large-scale scans of publicly deployed AI-generated apps keep finding the same two things wide open: listable storage buckets and hardcoded secrets in the JS bundle.
Read the postWordPress + AI: The Security Debt Nobody Budgeted For
WordPress vulnerabilities jumped sharply in 2025, and industry reports name AI-assisted development as a direct contributor. What changed, and how to check your site.
Read the postVibe Coding Security Statistics 2026: What the Data Actually Shows
Every credible number circulating about AI-generated app security, in one place — flaw rates, breach counts, CVE volume, and what they mean for you.
Read the postCORS Misconfiguration in AI-Generated Code
Why Cursor, Bolt, and Lovable keep shipping wildcard CORS origins by default — and the exact escalation pattern that turns it into a real vulnerability.
Read the postFirebase Security Rules Misconfiguration in Vibe-Coded Apps
Your Firebase API key being public is normal. Permissive security rules behind it are how attackers read your entire database.
Read the postJWT and Session Security Mistakes in AI-Generated Auth Code
Tokens that never expire, live in localStorage, and never get verified server-side — the auth shortcuts AI coding tools take by default.
Read the postExposed Source Maps in Production
What an attacker actually sees when your production .js.map files are publicly reachable — and the one config flag most AI scaffolds never set.
Read the post