State of Security Vibe-Coded Apps

Vibe coding democratizes app development — but it also democratizes insecure deployments. When non-technical users build production apps with AI and ship them without review, the failure modes are predictable: secrets baked into frontend bundles, database policies configured by an LLM that doesn't quite understand access control, PII sitting on unauthenticated endpoints.

Escape's security research team built a purpose-built scanner to test this at scale, running it across 5,600 apps built on Lovable, Base44, Bolt.new, and Create.xyz. The failure modes played out exactly as predicted — at a rate of 60% across the dataset. CVE-2025-48757, which disclosed insufficient Row-Level Security in Lovable-generated projects, was published in May. It was still live in apps we scanned.

Escape's research, methodology, and recommendations are here.