Why it matters
Building with AI is fast and fun. But the AI writes what you ask for, not what keeps you safe. Security usually isn’t part of the prompt, so it isn’t part of the site.
What usually goes wrong
- Secret keys leaked in the pageThe keys that let your site use paid services sit in code anyone can open. Whoever copies them can use those services on your bill.
- Your users’ data open to strangersThe place your site keeps its data answers anyone who asks, not only your signed-in users. Names, emails and messages can be read.
- Logins that can be skippedA page looks private, but a stranger can reach it without signing in.
- Fake emails sent in your nameNothing stops others from sending email that looks like it came from you.
- Missing basic protectionsSimple browser settings that block common tricks are off by default.
What the research says
In tests of code written by more than 100 AI models, about 44% of the tasks produced code with a security flaw. The models got better at writing code, but not at writing safe code.
Veracode, 2026 GenAI Code Security Report, July 2026 · source · report
Researchers looked at over 5,600 public vibe-coded apps from the outside. They found more than 2,000 vulnerabilities, over 400 leaked secret keys and 175 cases of exposed personal data. They call these numbers a lower bound.
Escape, research on vibe-coded apps, Oct 2025 · source
A scan of 1,645 apps showcased by one AI app builder found 170 of them with settings that let strangers read their data.
Matt Palmer, statement on CVE-2025-48757, May 2025 · source
On another AI app platform, a flaw let anyone get into private apps with nothing more than a public app ID. It was fixed within a day of being reported.
Wiz Research, Base44 vulnerability, July 2025 · source
Secret keys leaked on public GitHub in 2024 alone, 25% more than the year before.
GitGuardian, The State of Secrets Sprawl 2025, Mar 2025 · source
In a university study, people who used an AI assistant wrote significantly less secure code than people who didn’t.
Perry, Srivastava, Kumar, Boneh, ACM CCS 2023 · source
We only quote numbers we could check in the original report. Each one links to its source.
None of this means you shouldn’t vibe code
It means you should check. Most of these problems are easy to fix once you know they’re there, and your AI can fix them for you if you tell it what to fix. That’s what we do.
You vibe coded it. Is it safe?
Free. One minute. We only look at what any visitor can see.