Security Review for Vibe Coders · 20 min · Claude Code, Cursor, Lovable, v0, Bolt.new, Replit Agent, or similar

Why Vibe-Coded Apps Get Hacked

AI can build you a working app and a secure app for the same amount of typing — the difference is entirely in what you ask for and what you check.

Hiring signal: Every real vibe-coding breach so far traces back to the same root cause: nobody told the AI to secure a specific thing, and nobody checked whether it had. Spotting that pattern is the one habit this whole course is built around.

What you will learn

Explain what actually went wrong in the Moltbook and Lovable breaches, in plain English
Distinguish authentication (are you logged in) from authorization (should YOU see THIS) — the single most common failure
State the one habit that would have prevented both breaches

Introduction

Two vibe-coded apps made real news in 2026 — for the wrong reason. Both stories are short, both were avoidable, and both come down to the exact same mistake.

The Problem

Moltbook, an AI social network where autonomous agents posted and messaged each other, launched on January 28, 2026. Its founder said publicly he "didn't write a single line of code" — the whole thing was AI-built. Three days later, security researchers found the entire production database sitting open to the internet: 1.5 million API tokens, 35,000 email addresses, and thousands of private agent-to-agent messages — some of them containing plaintext OpenAI API keys the agents had shared with each other.

The cause wasn't exotic. The AI tool had wired the app up to Supabase (a common backend-as-a-service vibe coders use for a database and auth in one). It exposed the project's API key in the site's client-side JavaScript — completely normal, that key is supposed to be public — but it never turned on Row Level Security (RLS), the setting that actually restricts what that public key can read and write. Without RLS, the "public" key had full read/write access to every table in the database. The entire fix was two SQL statements.

Lovable, a $6.6B vibe-coding platform used by 8 million people, has had three separate public security incidents. The most recent: a BOLA vulnerability (more on this in a second) that stayed open for 48 days after Lovable's own team closed the bug report without escalating it.

One pattern, two breaches
Neither of these happened because an engineer made a subtle mistake under pressure. They happened because nobody — not the AI, not the founder — ever asked the specific question "who is allowed to see this data, and did we actually restrict it to them?" AI coding tools will happily ship an app that works without ever being asked to make it safe. Working and safe are two different requests.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Authentication vs. authorization — the distinction that keeps causing this, Why this matters even for a "small" project, Your Practice Rep — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.