Is Your Vibe-Coded App a Security Risk? Here's How to Find Out

In Veracode’s latest round of testing, 45% of the code that AI models generated shipped with a known security vulnerability baked in.

You’ve probably heard the reassuring version of this problem. Write a careful spec file, keep a tidy set of rules, and remind your coding assistant often enough to “never leave security vulnerabilities,” and you’ll get a secure app.

It’s a comforting idea, and there’s a whole industry gently selling it to you.

It’s also mostly not true. Over the last two years, Veracode has tested more than 150 AI models. Their results reveal that models have become much better at writing functional code, with more than 95% now syntactically correct.

But over the same period, security has barely improved: even today, only 55% of generated code passes basic security checks.

This post covers why vibe-coded apps tend to carry so much security risk, and then the practical ways to check whether yours is one of them.

Why Vibe-Coded Apps Carry So Much Risk

Let’s start by looking at some reasons why vibe coded apps generally have so many security issues.

It’s Only Looking at the Bug in Front of It

When you ask a coding tool to fix a specific bug, its entire world is that bug. It patches the file you pointed at and moves on.

What it usually doesn’t do is ask whether that fix loosened a permission check, disabled some validation, or widened a database query that used to be narrow.

The conversation was scoped to one bug. The consequences weren’t.

It Invents Packages That Attackers Are Waiting For

AI tools will confidently tell you to install libraries that don’t exist. A 2025 USENIX Security study found open-source models hallucinated package names 21.7% of the time (commercial models a still-uncomfortable 5.2%), producing over 205,000 unique fake names.

Seth Larson, a security researcher at the Python Software Foundation, named the resulting attack “slopsquatting”.

Here’s how it works.

1. An attacker figures out which fake package names AI tools keep suggesting.
2. They register one of those names for real and fill it with malware.
3. They wait for someone’s coding assistant to suggest that same fake name.
4. The victim copy-pastes the install command, and the malware lands straight into their app.

Nobody’s Auditing the Code

For as long as software applications have been a thing, there’s always been a need for someone other than the original author to review the code before it reaches customers.

In most vibe-coding workflows, that step either doesn’t happen, or the same AI tool that wrote the code is the one reviewing it (which isn’t really review at all).

The code works in the demo, so it ships, and nobody finds out what it missed until it’s live in front of real users.

The Platform Itself Can Hand You a Vulnerability

Sometimes the flaw has nothing to do with your prompt. It comes from the platform itself.

Security researcher Matt Palmer found that apps built on Lovable shipped with database access controls that looked fine but didn’t actually work. It’s now catalogued as CVE-2025-48757.

He found 303 vulnerable endpoints across more than 170 projects. Every single one had inherited the same hole from the platform.

None of this means that vibe coding is reckless. It means “it works” and “it’s safe” are different questions, and most workflows only ever ask the first one.

How to Check If Your App Is a Security Risk

The good news is that you don’t need to be a security engineer to get a real signal. Here are five checks, roughly in the order you should run them.

Scan for Exposed Secrets and API Keys

This is the most common problem and one of the most damaging: an API key, database password, or token committed into the repo and shipped with the app.

• Run gitleaks over your repository. It’s free, and it scans both your current code and your git history for anything that looks like a secret.

• Then manually open the files that vibe coding tools love to leave keys in, such as: .env, config files, and your Supabase or Firebase setup files. Our production readiness checklist has the full list.

One rule to internalize: if a key sits in code that the browser can download, treat it as already public and rotate it today.

Run a Free Automated Scanner

Static scanners read your code and flag common vulnerabilities without you needing to understand each one.

• Semgrep has a free tier and catches the usual suspects: SQL injection, cross-site scripting, and the other categories that showed up in the Veracode stats above.

• Run npm audit (built into npm) to surface dependencies with known vulnerabilities.

• Socket is worth adding specifically for the slopsquatting problem, since it flags malicious and suspicious packages before they land in your project.

Check Who Can Actually Reach Your Database

A lot of vibe-coded apps enforce access in the user interface and leave the database itself wide open.

The app only shows you your own data, so it feels locked down, but the database will happily hand over anyone’s records if you ask it directly.

If you’re on Supabase, this is Row Level Security, and it’s frequently either off or misconfigured. Here’s a test anyone can run:

1. Open your app and log in normally.
2. Load a page that shows your own data, like your profile or dashboard.
3. Open your browser’s dev tools (right-click the page, then Inspect) and click the Network tab.
4. Find the request that fetched your data, and change the ID in it to a different number.
5. Resend the request and see what comes back.

If you get someone else’s data back, your access control lives only in the front end.

Ask Your AI Tool for a Security Review, Then Verify

Most modern coding tools can run a review pass. Ask specifically for authentication problems, exposed secrets, injection risks, and OWASP Top 10 issues, rather than a vague “is this secure?”

It will find real things.

But remember it wrote the code, so it reviews with the same blind spots it built with.

Ask it to explain why each finding matters, then confirm the fix yourself before accepting it. AI tools are overconfident reviewers of their own work.

Treat the review as a first pass that generates leads, not a clean bill of health.

Get a Human to Audit and Harden It

The checks above catch the obvious holes. They won’t catch the subtle stuff, like a password reset flow that can be tricked into resetting someone else’s account, or an admin page that’s technically reachable by a regular user who knows where to look.

Scanners don’t threat-model, and neither does the tool that wrote the code.

That’s where an experienced engineer earns their keep. They can actually read the source, think like an attacker, and harden the app so that it can withstand targeted cyberattacks.

Wrapping Up

Vibe coding gets you a working app faster than ever before. What it doesn’t get you is an inherently safe one. We hope the checks in this guide give you a clearer read on where your app actually stands.

And if you ran them and didn’t love what you found, that’s exactly what we’re here for. We audit vibe-coded apps for security holes and harden them the right way. Check out our vibe code hardening service, or book yourself a free consultation.