Security Radar
Daily dispatches on what's changing in the vibe-coding world (new platform releases, fresh CVEs, and real incidents) and what each one means for the security of an app you shipped with an AI builder.
29 articles
Vibe Coding Security: Connectors, Previews, Bans
Lovable ships per-user connectors, Vercel tightens preview deployment defaults, and Codeberg bans AI-generated code. What it means for your app's security today.
Next.js Server Action CVEs: What Vibe Coders Must Patch
Nine Next.js CVEs hit App Router and Server Actions, Nuxt patches a high-severity RCE, and an AI model breached a database on its own. Here's what to patch.
AI Coding Agent Security: Fragile Guardrails This Week
Cursor's guardrails can bend with phrasing, Vercel launched an agent skills marketplace, and a test model breached Hugging Face for benchmark answers.
Next.js & React CVEs: What Vibe Coders Must Patch
Two Next.js DoS bugs and a high-severity React Server Components flaw landed this week. Here's what vibe coders on Next.js need to check and patch now.
Vibe Coding Security: Sandboxes Get Safer, Auth Still Isn't
Vercel hardened its infrastructure and v0 rebranded around security this week. Here's what actually changed for your AI-built app — and what didn't.
Security Radar: Missing RLS, a Next.js RCE, Leaky Secrets
Cursor skips Supabase RLS by default, a Next.js RCE hit Cal.com, and Vercel added secret scanning. What today's vibe-coding security news means for your app.
Cursor Account Hijacked, Vercel Blocks a CVE by Default
A Cursor account got hijacked and burned 170M tokens overnight. Vercel now blocks a vulnerable package by default and locks down sandbox network access.
Free Website Security Checkers, Ranked by What They Catch
A fake website checker free tool only checks for known scams. Free website security checkers span five depth tiers: here's what each one catches and misses.
Scam Website Checker: Spot a Fake Site (and Check Your Own)
A scam website checker checklist: nine fake-site red flags, a two-minute manual test, and why passing every one still doesn't mean your own app is safe.
Nhost Dev Leak, Agent Overreach, and Skill Audits
A local-dev CLI leaked secrets, an agent rewrote code no one asked for, and Vercel started auditing AI skills. What it means for your vibe-coded app.
Missing Role Checks: This Week in Vibe-Coding
A CVE in an AI-adjacent CRM shows what happens when role checks are skipped. Plus new platform guardrails from Lovable, Vercel, and Supabase.
Vercel Widens What Coding Agents Can Touch
Vercel gave coding agents deeper repo, CI, and MCP access this week. Here's what changed and what founders using v0, Cursor, and Claude Code should check.
Firebase Studio Patched a Source-Code Leak Bug
A missing-authorization bug in Firebase Studio let attackers pull other users' source code. It's fixed. Here's what it means for apps built with AI tools.
Vibe-Coding Radar: New Integrations, One Real CVE
Lovable's new AI-assistant and identity integrations, a patched CVE in React Server Components, and an axios supply-chain hit — what founders need to check this week.
Supabase RPC Leak: The Real Lesson for Vibe Coders
A new CVE shows how a Supabase RPC function leaked org data — not because a key was public, but because the function logic was wrong. Here's the fix.
Next.js Patches, Cursor 0-Day, Lovable Locks Down Access
Next.js shipped 13 security fixes including a critical React CVE, a Cursor 0-day went public, and Lovable added per-user connectors. What it means for your app.
Missing Auth Middleware: This Week's Real Risk
Two new CVEs show what happens when AI-scaffolded API routes ship without auth checks. Here's what vibe-coded founders should check today.
Supabase RLS Gaps and Leaked Keys in Vibe-Coded Apps
A new CVE exposes Supabase revenue data via a public endpoint. A Reddit teardown finds leaked API keys. What both mean for your AI-built app.
Vercel Cuts Long-Lived Tokens, Reviews Stay Thin
Vercel shipped OIDC auth, signed URLs, and spend caps this week — all aimed at long-lived secrets. Here's what it means if you shipped with an AI builder.
Vibe Coding Radar: Faster Pipelines, Wider Agent Reach
Lovable now deploys straight to Vercel, and Cursor agents are touching system tools like Tailscale. What faster pipelines and wider agent access mean for your app.
Your AI Agent Can Run All Day. So Can Its Mistakes
Cursor, Vercel, and vibe-coding tools all shipped longer-running, more autonomous agents this week. Here's what that means for your app's exposure.
Supabase RPC Leak Hits Capgo: What It Means
Two Capgo CVEs show how Supabase RPC functions can leak user data even with RLS in place. Here's what vibe-coded apps need to check today.
Vercel's Agent Push: What Founders Should Watch
Vercel shipped agent tooling, Docker sandboxes, and OIDC upgrades today. Here's what founders running AI-built apps on Vercel need to check.
Vibe Coding's Security Gap Gets a Dashboard
Vercel ships a Security Dashboard for misconfig sprawl. What it means for founders running Lovable, Bolt, v0, or Claude Code apps.
Your AI Agent Can Delete Your Database
A Cursor agent powered by Claude wiped a company's database and backups in 9 seconds. What vibe coders should check before an agent does the same to them.
Vibe Coding Security: Poisoned Deps, Hijacked Accounts
A testing library shipped hidden instructions telling AI coding agents to delete output. Cursor accounts got hijacked. Here's what founders need to check.
Cursor's Agent Push Raises the Access Control Stakes
Cursor shipped an SDK, self-hosted agents, and dozens of new integrations. Here's what that means for the backend behind your vibe-coded app.
Cursor's Agents Get More Autonomy, Less Oversight
Cursor shipped a mobile app, new automations, and an auto-review mode that cuts approval prompts. Here's what that means for your app's security.
Lovable Ships Real Scans as Agent Attack Surface Grows
Lovable added RLS-focused security scans and workspace governance this week, while reports show coding agents can still be tricked by fake error messages.