TLDR Tech / InfoSec
State of Vibe-Coded Security
4,783 AI-assisted apps were scanned, turning up 727 critical and over 5,000 high-severity issues, with 7% of Lovable and Bolt apps exposing Supabase databases publicly, while a YC control group had none. Several production systems leaked real data: therapy billing and schedules, full booking histories with chat logs, patient records via simple ID changes, CRM tables via public anon keys, and college enrollment data. Most criticals came from Supabase RLS left disabled, followed by client-exposed API keys, IDOR, unauthenticated OpenAPI endpoints, and AI-written code that referenced nonexistent security checks.
Read the full story