We scanned 1,764 vibe-coded apps. 453 had critical vulnerabilities. Here's what we found beyond Supabase RLS.

We just finished scanning 1,003 vibe-coded apps across Lovable, Bolt, Replit, Vercel, Streamlit, Heroku, and others. The Supabase RLS story is well-documented by now — 7% of Lovable apps and 6% of Bolt apps have tables wide open. But RLS accounted for 183 of our 190 CRITs. The other 7 came from finding classes that are arguably worse. 1. IDOR — health records accessible by incrementing an ID Two Replit apps had IDOR vulnerabilities: GET /api/bookings/{id} returns any user's booking details by it