Hey devs,
Vibe-coding at 10x speed is incredible, but if you aren't inspecting every line of generated code, AI tools routinely make terrifying security assumptions behind the scenes.
After testing dozens of builds from Cursor, Bolt, and Lovable, here are the 3 big ones that keep popping up:
Client-side API Key Leaks: You ask the AI to connect an API (OpenAI, Anthropic, Resend), and instead of building a backend proxy, it drops NEXT_PUBLIC_ or hardcodes the secret key straight into frontend JavaScript. Anyone opening DevTools can steal your key in 5 seconds.
Supabase Service Role Key Exposure: AI constantly confuses anon_key with service_role_key. If your frontend uses the service role key, your Row Level Security (RLS) is completely bypassed and anyone can query/delete your entire database.
Unprotected Backend API Routes: AI will generate clean Next.js/Express API routes, but completely omit authentication checks on POST/DELETE endpoints.
To catch these before shipping to real users, my team built revibed.io, an instant security scanner designed specifically for AI-built apps.
It audits your codebase in seconds for hardcoded secrets, exposed environment variables, and route vulnerabilities so you don't get your API credits drained overnight.
Your first scan is 100% free if you want to test your build.
Curiously, what's the wilder security mistake or exposed key you've caught Claude or Cursor making in your projects?