Security
The security holes AI-generated apps ship with, and how to catch them before production.
A vibe-coded product isn't done at the first deploy
PHP and Next.js flaws, 1,094 Microsoft fixes, 95,000 CVEs in 2026: a vibe-coded product is never done, and its maintenance starts on the day you deploy.
With AI, less secure code and more confident developers
A Stanford study: developers using AI wrote less secure code and felt more confident about it. The fix: have an AI with a fresh context audit the code.
IDOR: the security hole AI leaves in your routes
AI builds a route that returns an invoice by its id, but forgets to check who owns it. Here is the 3-step test to spot an IDOR in your own app.
Your secret API keys might be visible to everyone
AI puts keys wherever they work: in the bundle, so on everyone's machine. Here is how to check whether your secret API keys are visible on your website.
Supabase and RLS: the 2-minute check
AI sometimes forgets to enable RLS on Supabase tables created via SQL, and then anyone can read your database. Here is how to check it in 2 minutes.
A CVE on Lovable apps: the real cost of vibe coding
An official CVE on Lovable apps: with no data access rules, anyone can read the database. The app works, the demo looks great, and the door is wide open.