From VibeEval
Security research, product notes, and lessons from testing AI-built apps.
A week of escalation: Replit's CEO calls Apple's App Store block a 'total lie' and threatens court, Anthropic's Mythos preview helps Mozilla close 271 Firefox vulnerabilities, Google patches a CVSS-10 RCE in …
Read storyA 2026 survey of security scanners for apps built by Lovable, Bolt, Cursor, Replit, and V0. How legacy SAST, modern AI-flavored scanners, and DAST tools compare on the bugs that ship with AI-generated code.
Read storyWe tested Claude Sonnet 4.5, GPT-5, Gemini 2.5, Cursor, Lovable, Bolt, and Replit. None produce input validation that survives a red-team pass on iteration one. Drop-in three-iteration prompt for Codex and …
Read storyThree days in vibe-coding security: Apple blocks Replit and Vibecode App Store updates over post-approval code changes, Anthropic ships full TypeScript via Claude Code npm source maps, and Lovable launches …
Read storyApril 2026 was the month Lovable's exposure landscape went mainstream. RedAccess scanned 380,000 vibe-coded apps across Lovable, Base44, Replit, and Netlify. ~5,000 leaked corporate or personal data. Phishing …
Read storyFive days of vibe-coding security stories: Wiz launches Red Agent and AI-BOM at Google Cloud Next, SecureVibeBench numbers the AI secure-coding gap at 23.8%, Red Gate documents 5 database failure patterns, CEOs …
Read storySeven days of vibe-coding security stories in one place: Lovable's 48-day chat exposure, Anthropic's MCP RCE affecting 200,000+ servers, Gitar's $9M stealth exit, Aikido Endpoint's launch, and the …
Read storySnyk scanned 3,984 agent skills and found critical issues in 13.4% of them, with 76 confirmed malicious. A March 2026 arXiv paper tested MCP clients for prompt injection and found wildly uneven guardrails. The …
Read storyA Japanese beauty blogger shipped a real app with Claude Code in 2026 - and her post includes a whole section teaching Supabase Row-Level Security through an apartment analogy. Vibe coding has crossed over. RLS …
Read storyVercel confirmed a breach that started with a third-party AI tool an employee used. Attackers pivoted from Context.ai to Google Workspace to Vercel's infrastructure. v0 ships code to IBM, Uber, Nike, GitHub.
Read storyResearchers prompt-injected AI coding agents from Anthropic, Google, and Microsoft running inside GitHub Actions and exfiltrated API keys and access tokens. Bug bounties were paid. No public warnings went out …
Read storyResearcher discloses a Broken Object Level Authorization flaw on Lovable: change a project ID in the URL, free account, pull anyone's full source tree. .env files, live Supabase URLs, and API keys all exposed. …
Read story