Before you share a vibe-coded app, check these four security gaps

Tools such as Lovable, Replit and Base44 let you describe an app in plain language and publish it online. If you have used one to build a booking form for a small business, a member list for a persatuan or a tracker for the office, this guide is for you. Security researchers keep finding the same few mistakes in apps made this way, and some of those apps have leaked personal data. Here are the four gaps to check before you share the link.

What researchers have found

• Wiz Research looked at apps built on vibe-coding platforms and, in September 2025, published the four common, high-impact mistakes listed below. It shared the findings with Lovable, which wrote a security best practices guide for its users and, with Wiz, changed its system prompt so that putting secrets in browser code is treated as a security risk.
• Red Access, an Israeli security firm, reported in May 2026 that it found 380,000 publicly accessible assets built with Lovable, Base44, Replit and Netlify, according to VentureBeat. About 5,000 of them, or 1.3%, held sensitive corporate information. Examples included a Brazilian bank's internal financial data that anyone with the URL could open, and patient conversations at a children's long-term care facility. Lovable and Wix, which owns Base44, said Red Access did not share the URLs or details they needed to verify the findings. Replit's CEO said the firm gave Replit only 24 hours before going to the press.
• Moltbook, a social network for AI agents, exposed its production database in early 2026, Wiz reported. Its founder had said he "didn't write a single line of code" for it. A database key sat in the site's browser code with no access rules behind it, which exposed 1.5 million API tokens, 35,000 email addresses and 4,060 private conversations between agents. It was fixed about three hours after Wiz reported it.

The four gaps, and how to close them

1. Login checked in the browser. Wiz found apps where the password check ran entirely in the browser, sometimes with the password written straight into the code. Anyone can open that code and read it. Fix: make sure logins are checked on the server, using a proper sign-in service. When you prompt the AI, tell it that everything in the browser code is public.

2. API keys and secrets in the browser code. Keys for outside services and service account credentials were sitting in the app's JavaScript, where anyone could copy them. Fix: send calls to outside services through a backend. For Lovable apps, Wiz suggests Supabase Edge Functions, with the keys kept in Supabase Secrets.

3. Database tables open to everyone. Many vibe-coded apps use Supabase, where Row Level Security (RLS) rules decide who can read which rows. Wiz found these rules switched off or far too loose. In one case, a game built for a company leaked its users' personal details and IP addresses. Fix: start from "deny by default", then write clear rules that give access based on the logged-in user's ID or role, and test them.

4. Internal tools with no login at all. Wiz found internal knowledge bases, chatbots trained on sensitive data and test sites holding real data, all reachable by anyone who found the address. Fix: require a login for anything with sensitive data. Keep a list of every vibe-coded app your team has published, so none are forgotten.

A quick test you can do yourself

Open your app in a private or incognito browser window, without logging in, and try to reach pages and data that should be private. If you can see them, so can anyone else.

If your app holds personal data

Malaysia's data breach notification rules under the Personal Data Protection Act came into force on 1 June 2025. Under the Commissioner's guidelines, a breach that causes or is likely to cause significant harm, or affects more than 1,000 people, must be reported to the Commissioner as soon as practicable and within 72 hours, according to law firm DLA Piper. Where there is significant harm, affected people must be told within seven days of notifying the Commissioner. If your app collects names, phone numbers or IC numbers, these rules may apply to you.

Sources

• Wiz, Wiz Research Finds Risks in 20% of Vibe-Coded Apps, 18 September 2025
• Wiz, Hacking Moltbook: AI Social Network Reveals 1.5M API Keys, 2 February 2026
• VentureBeat, report on Red Access's scan of 380,000 vibe-coded assets, 8 May 2026
• DLA Piper Privacy Matters, Malaysia: Guidelines Issued on Data Breach Notification and Data Protection Officer Appointment, 4 March 2025