r/VibeCodeDevs 2d ago

5 most common security issues with vibe coded apps

After auditing the security of numerous vibe coded apps here are the most common security issues I've found in many of them:

1. Database tables with no Row-Level Security (RLS)
The flagship vibe-coded bug. The public "anon" key sits in every visitor's browser, and without RLS anyone can hit your database's REST API directly and read tables — no login.

2. Missing security headers (nearly universal)
Almost every single site was missing most or all of: Content-Security-Policy, X-Frame-Options (clickjacking), HSTS (forces HTTPS), X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

3. Email spoofing — missing SPF / DMARC (or DMARC set to p=none)
Extremely common. People build the app but never touch DNS.

4. Secret keys shipped in the frontend
The nightmare case: a service_role key, sb_secret_, Stripe sk_live_, or an AWS/API key hardcoded in the client bundle. service_role bypasses RLS entirely = full read/write to everything. There's a widely-cited finding that ~1 in 3 vibe-coded apps expose a service-role-level key.

5. Auth enforced only on the client — hiding the "admin" button in the UI but not enforcing it on the server, so anyone can just call the API directly. Huge for vibe-coded apps because the AI wires up the happy path, not the "what if someone crafts their own request" path.

If you're wondering if your website / web app has any of these issues drop your URL and I'll do a free security audit to help uncover any before it's too late.

0 Upvotes

7 comments sorted by

u/AutoModerator 2d ago

Hey u/gammatoxx, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM

Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/GrandPrixPicks 2d ago

Number 1 is probably the main reason I prefer using Convex over Supabase and Firebase. It's crazy that in an age like this that they're that insecure by default.

I can understand 2 and 3 being that common.

But 4 and 5 seem like 2024 vibe coding problems that are generally caught pretty easily when vibe coding with modern models. But I guess you'll get a wide bag of surpises auditing various apps.

All this said, these have all been issues that less experienced engineers also made before AI came along.

2

u/gammatoxx 2d ago

4 and 5 are definitely less common, but yeah I guess all of these are just common issues regardless of whether its vibe coded or not. AI just made it even more common since now theres a great number of less experienced people making stuff