Is My Site Hackable?
The vibe-coding security blog
Plain-English security guides for apps built with Lovable, Bolt, Cursor, v0, and Replit: RLS, exposed API keys, Firebase rules, and the real breaches, without the false alarms. We don't cry wolf: your Supabase anon key and Firebase config are public by design. We focus on what actually leaks.
Supabase Security
View all →Supabase is the default backend for most vibe-coded apps, so its security is the whole game. RLS, the anon vs service_role keys, storage buckets: what actually leaks, and what only looks scary.
Supabase Security for AI-Built Apps: The Complete Guide
A plain-English guide to Supabase security for AI-built apps. Learn the real risks — RLS, service keys, storage buckets — and how to check your own app today.
Is Your Website Secure? The Data-Leak Check Most Checkers Skip
Is this website secure? A padlock and malware scan only check the surface. See the data-leak check (missing RLS) most website security checkers skip entirely.
Website Security Scan: What It Checks and How to Run One Free
A real website security scan covers TLS, headers, exposed files, shipped secrets, and missing Row Level Security. See what it checks and run one free.
The Supabase Security Audit Checklist Before You Ship
A complete supabase security audit checklist: RLS on every table, storage buckets, key handling, auth config, and the SECURITY DEFINER functions attackers love.
Vibe Coding and Supabase Security Are the Same Problem
Vibe coding and Supabase security aren't two checklists, they're one. See why CVE-2025-48757 hit 170 of 1,645 apps and how to check your own app today.
CVE-2025-48757 Explained: How 170 Apps Leaked Through One Missing Policy
CVE-2025-48757 explained for non-developers: how 170 Lovable-built apps leaked real data through missing Supabase RLS — and how to check if yours did too.
Is My Supabase Exposed? Check It in 5 Minutes
Worried your Supabase data is exposed? Run this 5-minute self-audit: check RLS on every table, query your endpoints as a stranger, and spot USING(true) policies.
service_role vs anon Key: Which One Actually Ends Your Company
service_role vs anon key in Supabase: the anon key is safe in the browser, but a leaked service_role key bypasses all RLS. How to tell them apart and what to do.
Supabase RLS Explained: It's a WHERE Clause on Every Query
Supabase RLS in plain English: it's a WHERE clause your database adds to every query. Learn how Row Level Security works, why AI tools skip it, and how to check yours.
Supabase Storage Buckets: The Public-by-Default Mistake
Supabase storage security in plain English: how public buckets expose user photos, IDs, and receipts, how storage RLS works, and how to check your buckets.
Testing RLS the Right Way: anon, owner, and other-user
Learn how to test Supabase RLS for real using three personas — anon, owner, and other-user — with copy-paste curl and supabase-js examples. See a pass vs a leak.
The USING(true) Trap: RLS That Passes the Scan but Leaks Everything
One of the worst Supabase RLS mistakes: a USING(true) policy looks enabled but leaks every row. Learn why AI tools generate it and how to rewrite it safely.
Vibe Coding Security
View all →The big picture: why AI builders optimize for “it works” over “it’s secure,” what the research and the breaches show, and the checklist to ship without leaving the door open.
Vibe Coding Security: The Complete Guide
Vibe coding security, explained for non-developers. Why AI-built apps ship with leaks, the main risk classes, and how to check your own app in minutes.
How to Check If a Website Is Safe: The 2026 Checklist
Learn how to check if a website is safe: HTTPS, domain age, reviews, and blocklists in minutes, then the deeper checks a padlock alone cannot show you.
OWASP Top 10 for Vibe-Coded Apps (Plain English)
The OWASP Top 10 explained in plain English and mapped to what AI coding tools actually get wrong, so you know exactly what to check on your app first.
URL Checker: What Scanning a Link Really Tells You
A url checker scans a link for phishing, malware, and a valid certificate. Here is exactly what it checks, and why that says nothing about your own app.
Is My Vibe-Coded App Safe to Ship? The 10-Minute Check
Is your vibe-coded app safe to ship? Answer 5 yes/no questions in your browser to find out, no code reading required. Get a clear verdict in 10 minutes.
How We Taught Our Scanner to Detect IDOR
Our scanner missed one flaw: a broken-access-control IDOR. Here's how we taught its AI agent to detect IDOR on every run, without crying wolf on public keys.
We Built a Broken Vibe-Coded App to Test Our Scanner
We built a deliberately-broken vibe-coded app with 21 planted flaws to test our security scanner. It caught 19 of 20 — here's the one it missed, and why.
Are Vibe-Coded Apps Secure? We Scanned 61 to Find Out
Are vibe-coded apps secure? We scanned 61 live apps from Lovable, Bolt, v0, Replit, Cursor and Base44 — zero leaked a real key, but most flunk the basics.
45% of AI-Generated Code Ships With a Vulnerability: The Research
AI generated code security, by the numbers. Four studies — Veracode, Carnegie Mellon, Escape.tech, Tenzai — on how often AI code ships with a vulnerability.
DAST vs SAST for AI-Generated Apps (and Why Deployed-App Scanning Wins)
DAST vs SAST for AI-built apps: a security scanner for AI code should test the deployed app, not just read source. Here's why deployed-app scanning catches more.
Is Your Vibe-Coded App Leaking Data? The 7 Gaps in Every AI-Built App
Worried your vibe-coded app is leaking data? Here are the 7 security gaps that show up in nearly every AI-built app — and how to check each one yourself.
The Pre-Launch Security Checklist for Vibe-Coded Apps
A vibe coding security checklist for non-developers: the database, secrets, storage, auth, and header checks to run before you ship your AI-built app. Print and go.
The Vibe-Coding Breach Timeline: Enrichlead, Tea, Base44, Moltbook
A timeline of the biggest vibe coding breaches — Enrichlead, Tea, Base44, Moltbook. What happened, the real root cause, and the lesson behind each AI app breach.
Why AI Optimizes for 'It Works,' Not 'It's Secure'
Why is AI code insecure? Because models optimize for code that runs and demos well, not code that's safe. The mechanism behind AI code security problems, explained.
Exposed Secrets
View all →API keys in frontend code. Which ones are a real emergency (sk_live, service_role), which are public by design (pk_live, anon), and how to find, rotate, and stop leaking the dangerous ones.
Exposed Secrets and API Keys in Frontend Code: The Complete Guide
An exposed API key in your frontend isn't always an emergency. Learn which keys are public by design, which are real leaks, and how to find and rotate the dangerous ones.
Virus Website Checker Says Clean. Your API Key Says Otherwise.
A virus website checker only looks for malware served to visitors. It won't catch a secret API key sitting in your own JS bundle. Here's the difference.
How to Secure an API Key in Your Frontend (the Right Way)
Learn how to secure api key in frontend code: server-side proxies, correct env vars, key scoping, and rotation, with a copy-paste Next.js proxy example.
A Key Just Leaked — Rotate, Audit, Monitor (in That Order)
A secret key leaked? Here's the incident runbook: confirm it's actually secret, rotate it, audit for abuse, then monitor — because keys re-leak on the next deploy.
An Exposed OpenAI or Anthropic Key Is Someone Else's Bill on Your Card
An exposed OpenAI or Anthropic API key means strangers run up your bill and can reach your data. Learn where these keys belong, how to check yours, and how to fix it.
Did I Leak My Stripe Key? pk_live vs sk_live Explained
Found your Stripe key in your frontend? Whether it's an emergency depends on one letter. Learn pk_live vs sk_live and exactly what to do if you leaked the secret one.
How Attackers Extract Secrets From JS Bundles
An API key in your JavaScript can be pulled in minutes with no special tools. See exactly how attackers find secrets in a JS bundle — and run the same check on yourself.
Your Source Maps Are Publishing Your Source Code
Source map exposure can republish your entire codebase — comments, logic, and secrets — to anyone. Learn how to find leaked source maps and disable them in production.
Firebase Security
View all →Your Firebase web config is public by design; that is not the leak. The real risks are permissive Security Rules and open storage buckets. Here’s how to tell yours apart and lock them down.
Firebase Security for AI-Built Apps: The Complete Guide
Firebase security rules in plain English for vibe-coded apps. Your API key is public by design — learn what's actually secret and how to secure Firebase.
Is This Website Safe? What a Green Padlock Doesn't Tell You
Is this website safe? A padlock only proves the connection is encrypted. Learn what it hides on Firebase-backed apps and how to check the real risks yourself.
Firebase Security Rules for AI-Built Apps: Copy-Paste Templates
Copy-paste Firebase security rules templates for AI-built apps: owner-only docs, public-read content, auth-only collections, and locked Storage rules.
Firebase Security Rules: 12 Mistakes AI Tools Make
The 12 Firebase Security Rules mistakes AI builders ship — from allow read, write: if true to leftover test-mode rules — each with a quick before/after fix.
Firebase vs Supabase: A Security Comparison
Firebase vs Supabase security, compared evenly. Both ship a public client key — the real risk is the rules layer. See how each protects you and how each leaks.
Open Storage Buckets: The #1 Firebase Leak
Firebase Storage security is where the worst leaks happen. Learn how open buckets exposed 72,000 IDs, how to write owner-scoped rules, and how to check yours.
The Tea App Breach: How a Firebase Bucket Exposed 72,000 IDs
The Tea app breach explained: an unsecured Firebase Storage bucket exposed ~72,000 images, including ID photos. The root cause and how to check your buckets.
Your Firebase Web Config Is Public by Design — Here's What to Actually Secure
Is your Firebase API key safe to expose? Yes — the web config is public by design. Here's what it does, why rotating it is pointless, and what to actually lock down.
Platform Guides
View all →Is your AI builder safe to ship with? A clear, per-platform security rundown (Lovable, Bolt, Cursor, v0, Replit, Base44, and more) with the real incident behind each and a pre-launch checklist.
Is This Website Legit? How to Vet an App Built With AI
Is this website legit? Check real contact info, terms, and domain match first. Then learn why funded, legitimate apps built with AI can still leak data.
Is Base44 Safe? Security Risks and the Checklist Before You Ship
Is Base44 safe? Yes — but a real auth-bypass flaw hit it in 2025. Learn the actual risks of Base44 apps and the checklist to run before you ship.
Is Bolt Safe? Security Risks and the Checklist Before You Ship
Is Bolt safe to ship a real app on? The builder is fine — its Supabase defaults can leak data. The RLS risks, exposed-key traps, and a pre-ship checklist.
Is Claude Code Safe? Security Risks and the Checklist Before You Ship
Is Claude Code safe? The tool is fine — the risk is the code AI ships. See the research, the real risks in Claude Code apps, and the checklist before you ship.
Is Cursor Safe? Security Risks and the Checklist Before You Ship
Is Cursor safe to ship a real app on? The editor is fine — the code it generates can ship vulnerable. The Enrichlead story, the SSRF research, and a checklist.
Is Figma Make Safe? Security Risks and the Checklist Before You Ship
Is Figma Make safe? The tool is fine — the risk is the code AI generates. See the real risks in Figma Make apps and the checklist to run before you ship.
Is Lovable Safe? Security Risks and the Checklist Before You Ship
Is Lovable safe to ship a real app on? Yes — but its Supabase defaults can leak data. The RLS risks, the CVE-2025-48757 facts, and a pre-ship checklist.
Is Replit Safe? Security Risks and the Checklist Before You Ship
Is Replit safe to ship a real app on? The platform is fine — its AI agents and Supabase defaults carry real risks. RLS, secrets, agent access, and a checklist.
Is v0 Safe? Security Risks and the Checklist Before You Ship
Is v0 safe to ship a real app on? The Vercel tool is fine — the Supabase backend it wires up can leak data. The RLS risks, exposed keys, and a checklist.
Is Windsurf Safe? Security Risks and the Checklist Before You Ship
Is Windsurf safe? The tool is fine — the risk is the code AI generates. See the real risks in Windsurf apps and the checklist to run before you ship.
Security Radar
View all →Daily dispatches on what's changing in the vibe-coding world (new platform releases, fresh CVEs, and real incidents) and what each one means for the security of an app you shipped with an AI builder.
Vibe Coding Security: Connectors, Previews, Bans
Lovable ships per-user connectors, Vercel tightens preview deployment defaults, and Codeberg bans AI-generated code. What it means for your app's security today.
Next.js Server Action CVEs: What Vibe Coders Must Patch
Nine Next.js CVEs hit App Router and Server Actions, Nuxt patches a high-severity RCE, and an AI model breached a database on its own. Here's what to patch.
AI Coding Agent Security: Fragile Guardrails This Week
Cursor's guardrails can bend with phrasing, Vercel launched an agent skills marketplace, and a test model breached Hugging Face for benchmark answers.
Next.js & React CVEs: What Vibe Coders Must Patch
Two Next.js DoS bugs and a high-severity React Server Components flaw landed this week. Here's what vibe coders on Next.js need to check and patch now.
Vibe Coding Security: Sandboxes Get Safer, Auth Still Isn't
Vercel hardened its infrastructure and v0 rebranded around security this week. Here's what actually changed for your AI-built app — and what didn't.
Security Radar: Missing RLS, a Next.js RCE, Leaky Secrets
Cursor skips Supabase RLS by default, a Next.js RCE hit Cal.com, and Vercel added secret scanning. What today's vibe-coding security news means for your app.
Cursor Account Hijacked, Vercel Blocks a CVE by Default
A Cursor account got hijacked and burned 170M tokens overnight. Vercel now blocks a vulnerable package by default and locks down sandbox network access.
Free Website Security Checkers, Ranked by What They Catch
A fake website checker free tool only checks for known scams. Free website security checkers span five depth tiers: here's what each one catches and misses.
Scam Website Checker: Spot a Fake Site (and Check Your Own)
A scam website checker checklist: nine fake-site red flags, a two-minute manual test, and why passing every one still doesn't mean your own app is safe.
Nhost Dev Leak, Agent Overreach, and Skill Audits
A local-dev CLI leaked secrets, an agent rewrote code no one asked for, and Vercel started auditing AI skills. What it means for your vibe-coded app.
Missing Role Checks: This Week in Vibe-Coding
A CVE in an AI-adjacent CRM shows what happens when role checks are skipped. Plus new platform guardrails from Lovable, Vercel, and Supabase.
Vercel Widens What Coding Agents Can Touch
Vercel gave coding agents deeper repo, CI, and MCP access this week. Here's what changed and what founders using v0, Cursor, and Claude Code should check.
Firebase Studio Patched a Source-Code Leak Bug
A missing-authorization bug in Firebase Studio let attackers pull other users' source code. It's fixed. Here's what it means for apps built with AI tools.
Vibe-Coding Radar: New Integrations, One Real CVE
Lovable's new AI-assistant and identity integrations, a patched CVE in React Server Components, and an axios supply-chain hit — what founders need to check this week.
Supabase RPC Leak: The Real Lesson for Vibe Coders
A new CVE shows how a Supabase RPC function leaked org data — not because a key was public, but because the function logic was wrong. Here's the fix.
Next.js Patches, Cursor 0-Day, Lovable Locks Down Access
Next.js shipped 13 security fixes including a critical React CVE, a Cursor 0-day went public, and Lovable added per-user connectors. What it means for your app.
Missing Auth Middleware: This Week's Real Risk
Two new CVEs show what happens when AI-scaffolded API routes ship without auth checks. Here's what vibe-coded founders should check today.
Supabase RLS Gaps and Leaked Keys in Vibe-Coded Apps
A new CVE exposes Supabase revenue data via a public endpoint. A Reddit teardown finds leaked API keys. What both mean for your AI-built app.
Vercel Cuts Long-Lived Tokens, Reviews Stay Thin
Vercel shipped OIDC auth, signed URLs, and spend caps this week — all aimed at long-lived secrets. Here's what it means if you shipped with an AI builder.
Vibe Coding Radar: Faster Pipelines, Wider Agent Reach
Lovable now deploys straight to Vercel, and Cursor agents are touching system tools like Tailscale. What faster pipelines and wider agent access mean for your app.
Your AI Agent Can Run All Day. So Can Its Mistakes
Cursor, Vercel, and vibe-coding tools all shipped longer-running, more autonomous agents this week. Here's what that means for your app's exposure.
Supabase RPC Leak Hits Capgo: What It Means
Two Capgo CVEs show how Supabase RPC functions can leak user data even with RLS in place. Here's what vibe-coded apps need to check today.
Vercel's Agent Push: What Founders Should Watch
Vercel shipped agent tooling, Docker sandboxes, and OIDC upgrades today. Here's what founders running AI-built apps on Vercel need to check.
Vibe Coding's Security Gap Gets a Dashboard
Vercel ships a Security Dashboard for misconfig sprawl. What it means for founders running Lovable, Bolt, v0, or Claude Code apps.
Your AI Agent Can Delete Your Database
A Cursor agent powered by Claude wiped a company's database and backups in 9 seconds. What vibe coders should check before an agent does the same to them.
Vibe Coding Security: Poisoned Deps, Hijacked Accounts
A testing library shipped hidden instructions telling AI coding agents to delete output. Cursor accounts got hijacked. Here's what founders need to check.
Cursor's Agent Push Raises the Access Control Stakes
Cursor shipped an SDK, self-hosted agents, and dozens of new integrations. Here's what that means for the backend behind your vibe-coded app.
Cursor's Agents Get More Autonomy, Less Oversight
Cursor shipped a mobile app, new automations, and an auto-review mode that cuts approval prompts. Here's what that means for your app's security.
Lovable Ships Real Scans as Agent Attack Surface Grows
Lovable added RLS-focused security scans and workspace governance this week, while reports show coding agents can still be tricked by fake error messages.