The ways AI-built apps actually break.
A handful of issues account for nearly every vulnerability in vibe-coded apps. Each one is invisible in a working demo and obvious to an attacker. Pick an issue for how it happens, a 30-second self-check, and the real fix.
Exposed API keys
An exposed API key is a live credential — for Supabase, OpenAI, Stripe or similar — that ends up in your app's browser bundle or public repo, where anyone can copy it.
How to check & fix →CriticalExposed database (RLS)
Supabase (the database most AI builders use) is only safe when row-level security — RLS — is enabled with real policies.
How to check & fix →HighClient-side-only auth
Client-side-only auth is a login gate that lives in a React component instead of on the server.
How to check & fix →HighRisky dependencies
AI builders add packages by name, which creates two risks: real packages that have drifted into known CVEs, and "hallucinated" package names the model invented — which an attacker can register and fill with malware (a technique called slopsquatting).
How to check & fix →HighExposed .env / .git
Even with clean code, a misconfigured deployment can serve files that should never be public — a .env full of secrets, or a .git directory that lets anyone reconstruct your entire source.
How to check & fix →Or check by the tool you built with
New here? Start with the vibe coding security guide — the full picture, backed by live data.