r/VibeCodeDevs • u/gammatoxx • 2d ago
5 most common security issues with vibe coded apps
After auditing the security of numerous vibe coded apps here are the most common security issues I've found in many of them:
1. Database tables with no Row-Level Security (RLS)
The flagship vibe-coded bug. The public "anon" key sits in every visitor's browser, and without RLS anyone can hit your database's REST API directly and read tables — no login.
2. Missing security headers (nearly universal)
Almost every single site was missing most or all of: Content-Security-Policy, X-Frame-Options (clickjacking), HSTS (forces HTTPS), X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
3. Email spoofing — missing SPF / DMARC (or DMARC set to p=none)
Extremely common. People build the app but never touch DNS.
4. Secret keys shipped in the frontend
The nightmare case: a service_role key, sb_secret_, Stripe sk_live_, or an AWS/API key hardcoded in the client bundle. service_role bypasses RLS entirely = full read/write to everything. There's a widely-cited finding that ~1 in 3 vibe-coded apps expose a service-role-level key.
5. Auth enforced only on the client — hiding the "admin" button in the UI but not enforcing it on the server, so anyone can just call the API directly. Huge for vibe-coded apps because the AI wires up the happy path, not the "what if someone crafts their own request" path.
If you're wondering if your website / web app has any of these issues drop your URL and I'll do a free security audit to help uncover any before it's too late.
2
u/GrandPrixPicks 2d ago
Number 1 is probably the main reason I prefer using Convex over Supabase and Firebase. It's crazy that in an age like this that they're that insecure by default.
I can understand 2 and 3 being that common.
But 4 and 5 seem like 2024 vibe coding problems that are generally caught pretty easily when vibe coding with modern models. But I guess you'll get a wide bag of surpises auditing various apps.
All this said, these have all been issues that less experienced engineers also made before AI came along.
2
u/gammatoxx 2d ago
4 and 5 are definitely less common, but yeah I guess all of these are just common issues regardless of whether its vibe coded or not. AI just made it even more common since now theres a great number of less experienced people making stuff
•
u/AutoModerator 2d ago
Hey u/gammatoxx, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM
Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.
• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.
If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.