Is my vibe-coded app secure?

Probably not — at least not without a deliberate review. Veracode's 2025 research found roughly 45% of AI-generated code samples introduced a known security vulnerability. Vibe-coded apps move fast but skip the security review that would catch exposed credentials, missing auth checks, and open database access before they reach real users.

Why AI-generated code has a specific security problem

AI coding tools are optimised to produce working output, not secure output. When you prompt Cursor, Bolt, or Lovable to scaffold an API route or a database integration, the generated code will function — but it may skip row-level security, omit authentication middleware, or inline credentials that should live in environment variables.

This is not a failure of the tools. It is a mismatch between what the tools optimise for (functional output given the prompt) and what production software requires (a security posture appropriate to the threat model). Most prompts do not mention security, so the model does not surface it.

Veracode's 2025 research, which found roughly 45% of AI-generated code samples introduced a known security vulnerability, reflects this gap at scale. It does not mean every AI-generated function is exploitable — but it does mean the default assumption should be scrutiny, not trust.

Common vulnerabilities in vibe-coded apps

The vulnerability patterns below are specific to the AI-native stack — Supabase, Next.js App Router, Vercel, and builder tools like Bolt and Lovable. They are consistently underweighted because speed-to-launch is the primary driver and security review rarely gets a dedicated slot.

Self-audit checklist: run this before you launch

You do not need a hired specialist to catch the most critical issues. Work through this checklist before your app touches real users or real data. Each item is actionable without deep security expertise.

1. Search your entire codebase for hardcoded secrets. Run a grep for common patterns: sk_live, supabase.co with adjacent key strings, OPENAI_API_KEY assigned inline, Stripe keys, Resend keys, Clerk secrets. Any credentials found should be rotated immediately in the service dashboard and moved to environment variables.
2. Check every Supabase table for row-level security. In the Supabase dashboard, open the Table Editor and verify RLS is enabled on every table that stores user data. Then review the policies: does each policy actually restrict access to the correct user? A table with RLS enabled but no policies denies all access; a table with a misconfigured policy may still expose all rows.
3. Audit every API route and Server Action for auth checks. In Next.js App Router, every route.ts file and every server action should validate session before executing. Check that unauthenticated requests get a 401, not a 200 with an empty payload.
4. Confirm you are using the anon key, not the service role key, on the client. The Supabase service role key bypasses all RLS. It should only ever appear in server-side code — not in environment variables prefixed with NEXT_PUBLIC_, and never in any client-side bundle.
5. Validate all user inputs before they reach the database. Any field a user can write to — forms, URL parameters, query strings — should be validated against a schema (Zod is common in this stack) before being passed to a query or stored.
6. Check file upload endpoints for type and size validation. AI-generated file upload handlers often accept any file type and any size. Add an allowlist of MIME types and a maximum file size before your storage bucket becomes an open host.
7. Review your CORS and Content-Security-Policy headers. In next.config, tighten Access-Control-Allow-Origin to specific domains rather than wildcard, and add a minimal CSP that blocks inline scripts you did not explicitly allow.

When to hire a security auditor

The self-audit above addresses the most common and exploitable issues. There are scenarios where bringing in a specialist is the right move, regardless of how thorough your own review was.

Hire an auditor if your app handles payments or financial data, stores health or medical information, holds data on behalf of other businesses (B2B SaaS), or is approaching a funding conversation where a technical due diligence review is likely. These situations create material liability, and a code audit by a qualified specialist is cheaper than an incident.

You should also consider a professional review if your app has grown through multiple AI-assisted iterations without systematic review — common with vibe-coded builds where each session adds features without revisiting the security posture of existing ones. Technical debt compounds; security debt compounds faster.

How to vet a developer for a security audit

Not every developer who can audit code can audit a vibe-coded app effectively. The AI-native stack has patterns — Supabase RLS, Next.js Server Actions, edge functions, builder-tool output — that a traditional appsec engineer may not be familiar with. Vet specifically for this combination.

1. Ask for examples of Supabase security work specifically. RLS policy design, service role key handling, and storage bucket permissions are the most common attack surface in this stack. If they cannot speak fluently about RLS policy logic, find someone who can.
2. Ask them to describe what they look for in AI-generated code. A developer who understands the specific failure modes of Cursor, Bolt, or Lovable output will find issues faster than one running a generic OWASP checklist.
3. Expect a written report, not just a Slack message. A proper audit produces a prioritised list of findings with severity ratings and specific remediation steps. If the developer cannot commit to a written deliverable, that is a signal about the rigour of the work.
4. Agree on scope before engagement. Define whether the audit covers static code review only, or also includes dynamic testing (running the app and probing it). Static review is faster and cheaper; dynamic testing catches issues that only appear at runtime. For most early-stage vibe-coded apps, static plus a focused manual test of critical flows is the right scope.

Frequently asked questions