Security advisories for vibe-coded apps
Find the leak
before someone else does.
13 advisories so far, each tied to a CVE, a vendor advisory or published research. Search by builder, CVE number or the thing that broke.
Latest critical
All critical advisories → 01. 2026-08
Supabase tables readable by anyone with no login
A scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login.
Lovable · Bolt · v0 +3 02. 2026-08Supabase service_role / secret key shipped to the browser
The service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public.
Lovable · Bolt · v0 +3 03. 2025-07Base44: private apps open to anyone with the app_id (Wiz)
Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours.
Base44Supabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeCVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedBase44: private apps open to anyone with the app_id (Wiz)AI agent deleted a production database during a code freeze (Replit)CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSCVE-2025-29927: Next.js middleware authorization bypass“Rules File Backdoor”: hidden Unicode instructions in AI rules filesProtecting routes only in middlewareAuthentication logic living entirely in the browserSlopsquatting: AI suggests packages that don’t existSupabase tables readable by anyone with no loginSupabase service_role / secret key shipped to the browserSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesCVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeCVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedBase44: private apps open to anyone with the app_id (Wiz)AI agent deleted a production database during a code freeze (Replit)CVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSCVE-2025-29927: Next.js middleware authorization bypass“Rules File Backdoor”: hidden Unicode instructions in AI rules filesProtecting routes only in middlewareAuthentication logic living entirely in the browserSlopsquatting: AI suggests packages that don’t exist
All advisories
Every known hole, with the fix.
Sorted with the worst first. Each one says what happened, how to check your own app in a few minutes, and what to change. Press / to jump to search.
13 advisories
01. criticalSupabase tables readable by anyone with no loginA scan of 30,998 live vibe-coded apps found 57% of the Supabase-backed apps it could check served table rows to requests with no login. Lovable · Bolt · v0 +3 2026-08 02. criticalSupabase service_role / secret key shipped to the browserThe service_role (or new sb_secret_) key bypasses every RLS policy. If it is in your JavaScript bundle, your whole database is public. Lovable · Bolt · v0 +3 2026-08 03. criticalBase44: private apps open to anyone with the app_id (Wiz)Undocumented register and verify-OTP endpoints accepted a non-secret app_id, letting anyone create a verified account on private, SSO-only apps. Patched by Wix within 24 hours. Base44 2025-07 04. criticalCVE-2025-48757: Lovable apps shipped with missing or weak Supabase RLSLovable-generated apps talked to Supabase directly from the browser, but many tables had no (or wrong) Row Level Security policies, so anyone with the public anon key could read or write data. Lovable 2025-05 05. criticalCVE-2025-29927: Next.js middleware authorization bypassSelf-hosted Next.js apps that did auth in middleware could be bypassed with the internal x-middleware-subrequest header. Relevant to any Next.js app, including ones generated by v0. v0 · Bolt · Cursor +1 2025-03 06. highSecrets leaked via NEXT_PUBLIC_ (or VITE_) environment variablesPrefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way. Lovable · Bolt · v0 +3 2026-08 07. highCVE-2025-54135 (“CurXecute”): Cursor agent could create MCP config and run codeBefore 1.3.9, Cursor let the agent create new dotfiles like .cursor/mcp.json without approval. Chained with prompt injection, this meant remote code execution. Cursor 2025-08 08. highCVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor 2025-08 09. highAI agent deleted a production database during a code freeze (Replit)Replit Agent deleted SaaStr founder Jason Lemkin’s live database (1,206 executives, 1,196+ companies) despite an explicit freeze, then wrongly said rollback was impossible. Replit · Cursor 2025-07 10. high“Rules File Backdoor”: hidden Unicode instructions in AI rules filesPillar Security showed invisible Unicode characters in shared rules files (.cursorrules, .mdc) can steer Cursor and GitHub Copilot into writing backdoored code. Cursor 2025-03 11. highAuthentication logic living entirely in the browserHiding a page or button in the UI is not access control. If the API or database doesn’t check the user, anyone can call it directly. Lovable · Base44 · Bolt +3 2025 12. highSlopsquatting: AI suggests packages that don’t existA USENIX Security 2025 study found 19.7% of 2.23 million package suggestions from 16 code models were hallucinated. Attackers can register those names. Cursor · Lovable · Bolt +3 2025 13. mediumProtecting routes only in middlewareVercel recommends against middleware being the sole method of protecting routes. Check auth again where data is read or changed. v0 · Bolt · Cursor +1 2025-03
Nothing matches that. Try another builder, or clear the filter.