The 12 Security Issues I Keep Finding in Vibe-Coded Apps (Lovable, Bolt, v0)

Over the last few weeks I've been running VibeScan — a security audit tool for AI-generated codebases — against a small set of public Lovable / Bolt / v0 / Cursor apps. Same dozen issues keep surfacing. If you're shipping a vibe-coded SaaS, run through this list before launch. It'll take you 30 minutes and save you from the most common self-own patterns. 1. Payment webhook has verify_jwt = false and no signature check What you'll find in your repo # supabase/config.toml [functions.payment-webhoo