{"slug": "7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by", "title": "7 Security Holes We Keep Finding in Vibecoded Apps: Audit Vibe Coding by Inithouse", "summary": "Inithouse's Audit Vibe Coding tool has identified seven recurring security vulnerabilities in AI-generated applications after scanning hundreds of projects. The most common issues include hardcoded credentials, missing authentication middleware, SQL injection via raw queries, exposed secrets in git history, permissive CORS configurations, and absent rate limiting on auth endpoints. Each vulnerability can be detected with simple grep commands and fixed in under five minutes.", "body_md": "We run [Audit Vibe Coding](https://auditvibecoding.com) at Inithouse, a security audit tool built specifically for AI-generated projects. After scanning hundreds of vibecoded apps, the same seven vulnerabilities show up over and over. None of them are exotic. All of them are fixable in under five minutes each.\n\nHere they are, with a grep command you can run right now to check your own codebase.\n\nAI code generators love placeholder values. They drop in `sk-test-abc123`\n\nor `API_KEY=your-key-here`\n\n, and you replace them with real credentials during development. Then you forget to move them to environment variables.\n\nWe have found live Stripe keys, Supabase service role tokens, and OpenAI API keys sitting in plain JavaScript files.\n\n**Check yours (2 min):**\n\n```\ngrep -rnI \\\n  \"sk-\\|sk_live\\|sk_test\\|api_key\\s*=\\|apiKey\\s*[:=]\\|secret_key\\|SUPABASE_SERVICE_ROLE\\|password\\s*[:=]\\s*['\\\"\\\"]\" \\\n  src/ lib/ app/ --include=\"*.ts\" --include=\"*.tsx\" --include=\"*.js\" --include=\"*.jsx\"\n```\n\nAny hit that contains a real credential (not a `.env`\n\nreference) is a problem. Move it to `.env`\n\nand add `.env`\n\nto `.gitignore`\n\n.\n\nAI generates beautiful CRUD endpoints. It rarely adds auth middleware unless you specifically ask for it. The result: anyone with your API URL can read, create, update, or delete data.\n\nWe see this most often in Next.js API routes and Supabase Edge Functions where the generator builds the handler but skips the auth check entirely.\n\n**Check yours (3 min):**\n\n```\n# Next.js API routes without auth\ngrep -rL \"getServerSession\\|getToken\\|auth(\\|middleware\\|supabase.*auth\" \\\n  app/api/ pages/api/ 2>/dev/null\n\n# Supabase Edge Functions without JWT verification\ngrep -rL \"Authorization\\|jwt\\|verify\" \\\n  supabase/functions/ 2>/dev/null\n```\n\nFiles that appear in the output have no authentication logic. Add middleware or a session check before any data operation.\n\nModern ORMs and query builders handle parameterization automatically. But when AI writes raw SQL (or when you ask it to \"make a custom query\"), it often builds the query with template literals instead of parameterized placeholders.\n\nOne vibecoded app we audited had a search endpoint that concatenated user input directly into a Postgres query. Classic injection vector, year 2026.\n\n**Check yours (2 min):**\n\n```\ngrep -rnE \"query\\s*\\(\\s*\\`|execute\\s*\\(\\s*\\`|sql\\s*\\(\\s*\\`\" \\\n  src/ lib/ app/ supabase/ --include=\"*.ts\" --include=\"*.js\"\n```\n\nIf you see `${userInput}`\n\ninside a query template literal, replace it with a parameterized query. In Supabase: use `.rpc()`\n\nor the query builder. In raw Postgres: use `$1, $2`\n\nplaceholders.\n\nEven if your `.env`\n\nis now in `.gitignore`\n\n, it might already be in your git history from an earlier commit. AI-generated projects often start without a proper `.gitignore`\n\n, and the first few commits include everything.\n\n**Check yours (2 min):**\n\n```\ngit log --all --diff-filter=A --name-only --pretty=format: | \\\n  grep -E \"\\.env$|\\.env\\.local$|\\.env\\.production$\" | sort -u\n```\n\nIf you get results, those files are in your history. If the repo is public (or was ever public), rotate every credential in those files. Use `git filter-repo`\n\nor BFG Repo-Cleaner to scrub the history.\n\nAI sets `Access-Control-Allow-Origin: *`\n\nbecause it works immediately during development. Nobody changes it before deploy. Now any website can make authenticated requests to your API.\n\n**Check yours (1 min):**\n\n```\ngrep -rnE \"Access-Control-Allow-Origin.*\\*|cors\\(\\s*\\)|origin:\\s*true|origin:\\s*\\*\" \\\n  src/ app/ lib/ next.config.* vite.config.* --include=\"*.ts\" --include=\"*.js\" --include=\"*.mjs\" 2>/dev/null\n```\n\nReplace the wildcard with your actual domain. If you use a framework's CORS middleware, set `origin`\n\nto your production URL explicitly.\n\nLogin, signup, password reset: these endpoints get brute-forced constantly. AI generates the auth flow but almost never adds rate limiting. We regularly find login endpoints that accept unlimited requests per second.\n\n**Check yours (3 min):**\n\n```\n# Find auth-related endpoints\ngrep -rn \"login\\|signin\\|signup\\|register\\|reset.password\\|forgot.password\" \\\n  app/api/ pages/api/ src/routes/ supabase/functions/ \\\n  --include=\"*.ts\" --include=\"*.js\" -l 2>/dev/null\n\n# Then check if those files reference any rate limiting\nfor f in $(grep -rl \"login\\|signup\\|reset.password\" app/api/ pages/api/ src/routes/ 2>/dev/null); do\n  grep -L \"rateLimit\\|rate.limit\\|throttle\\|limiter\" \"$f\"\ndone\n```\n\nFiles in the second output have auth logic but no rate limiting. Add a limiter (e.g., `express-rate-limit`\n\n, Upstash ratelimit, or Supabase's built-in rate limiting on Edge Functions).\n\nThe AI builds a nice admin dashboard with `{isAdmin && <AdminPanel />}`\n\nin React. But the API endpoint behind it serves data to anyone who calls it directly. The frontend hides the button; the backend serves the data regardless.\n\nThis is the most common hole we find. Frontend visibility checks create an illusion of security.\n\n**Check yours (5 min):**\n\n```\n# Frontend role checks (these are UI-only, not security)\ngrep -rn \"isAdmin\\|role\\s*===\\|user\\.role\\|user\\.type\\|canEdit\\|hasPermission\" \\\n  src/components/ src/pages/ app/ --include=\"*.tsx\" --include=\"*.jsx\" 2>/dev/null\n\n# Now check: do the corresponding API routes verify roles server-side?\ngrep -rL \"role\\|admin\\|permission\\|authorize\" \\\n  app/api/ pages/api/ supabase/functions/ 2>/dev/null\n```\n\nEvery permission check in the frontend needs a matching check on the server. If the server endpoint does not verify the user's role, anyone can call it directly with curl or Postman.\n\nThese seven holes share a root cause: AI generates code that works. \"Works\" and \"secure\" are different things. The generator optimizes for functionality, not for defense.\n\nWe built [Audit Vibe Coding](https://auditvibecoding.com) at Inithouse because we kept running into these same issues across our own portfolio of products. The tool runs a scored audit across security, SEO, performance, accessibility, and code quality, then hands you a prioritized list of fixes. No account needed.\n\nRun the grep commands above. If even one returns a hit, your app probably has more issues underneath. That is normal for vibecoded projects. What matters is catching them before someone else does.", "url": "https://wpnews.pro/news/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by", "canonical_source": "https://dev.to/jakub_inithouse/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by-inithouse-4gc0", "published_at": "2026-06-25 19:21:29+00:00", "updated_at": "2026-06-25 19:43:10.973340+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools", "ai-products"], "entities": ["Inithouse", "Audit Vibe Coding", "Stripe", "Supabase", "OpenAI", "Next.js", "Postgres"], "alternates": {"html": "https://wpnews.pro/news/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by", "markdown": "https://wpnews.pro/news/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by.md", "text": "https://wpnews.pro/news/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by.txt", "jsonld": "https://wpnews.pro/news/7-security-holes-we-keep-finding-in-vibecoded-apps-audit-vibe-coding-by.jsonld"}}