How many vibe-coded apps have security vulnerabilities?

Escape.tech scanned 5,600 publicly available vibe-coded apps and found 2,000+ vulnerabilities, 400 exposed secrets, and 175 instances of leaked personal data. Veracode found 45% of AI-generated code contains OWASP Top-10 vulnerabilities.

What are the most common security failures in vibe-coded SaaS?

Authentication bypass, missing row-level security, exposed API keys, command injection, and server-side request forgery are the most frequent critical issues found in vibe-coded apps.

Is there a security scanner built for vibe-coded apps?

VAS (Vibe App Scanner) and VibeSec launched in 2026 but are both pre-revenue with minimal traction. Lovable has a built-in scanner but only covers Lovable apps. No dominant platform exists for the broader market.

← Back to dashboard

clawsmith.com/signal/vibe-coded-saas-ships-with-critical-vulnerabilities

⚠ IssueUnderservedSaaS Web AppLive

Vibe-Coded SaaS Ships with Critical Vulnerabilities and No Security Review

Cluster of high-engagement HN threads (Apr 2026, 616+213+132 pts combined) exposing that vibe-coded web apps built with Lovable, Bolt.new, and Cursor are shipping OWASP Top-10 vulnerabilities, exposed secrets, and leaked personal data to production. 5,600 scanned apps had 2,000+ vulnerabilities, 400 exposed secrets.

Product Idea from this Signal

A web app that scans vibe-coded and AI-generated apps for OWASP Top-10 vulnerabilities and exposed secrets before they ship to production

1.1k ▲

Developers building with Lovable, Bolt.new, Cursor, and other AI coding tools routinely ship apps with critical vulnerabilities baked in: SQL injection, broken auth, exposed secrets, insecure direct object references. A scan of 5,600 vibe-coded apps found 2,000+ vulnerabilities and 400+ exposed secrets, yet no dominant SaaS-grade security platform has emerged for this specific audience. This web app lets builders paste a repo URL or deploy link, runs an automated OWASP Top-10 + secrets scan with no source code upload required, and returns a prioritized fix report with remediation prompts they can feed directly back into their AI coding tool.

SECURITYVIBE-CODINGAI-GENERATED-CODESASTOWASPSECRETS-SCANNINGDEVTOOL

Competitive482 leadsView Opportunity →