From VibeEval
Security research, product notes, and lessons from testing AI-built apps.
Kiro IDE's pitch is docs-first AI coding with automated security scans on every save. On paper it kills vibe-coding mistakes. In practice it is less AI tool, more compliance gate in AI cosplay.
Read storyDeepKeep shipped Vibe AI Red Teaming: human-in-the-loop attacks on AI apps and agents, with natural-language steering. CTO says it's 'the natural next step' after vibe coding. Good news for the category - but …
Read storyA new formal-verification study by Blain & Noiseux (Cobalt AI, April 2026) tested 7 production LLMs on 500 security-critical prompts and Z3-proved 1,055 exploitable vulnerabilities across 3,500 artifacts. …
Read storyLovable announced $100 pentesting via Aikido. We compare what you get: blackbox/greybox/whitebox testing, OWASP coverage, compliance reports, and how VibeEval
Read storyApple removed Anything -- a $100M vibe coding app -- from the App Store and blocked updates for Replit and Vibecode. Here
Read storyScan code built with Windsurf (Codeium) for security flaws instantly. 13 AI agents test for exposed secrets, broken auth, and insecure API patterns. No signup required.
Read storyScan code built with GitHub Copilot for security flaws instantly. 13 AI agents test for injection vulnerabilities, insecure patterns, and exposed secrets. No signup required.
Read storyScan apps built with Firebase Studio for security flaws instantly. 13 AI agents test for misconfigured Firestore rules, exposed credentials, and broken auth. No signup required.
Read storyStop manually retesting your app. Automatic security testing that catches vulnerabilities in AI-generated code before users do. Works with Lovable, Cursor, Bolt, and more.
Read storyStop manually retesting your app. Automatic security testing that catches vulnerabilities in AI-generated code before users do. Works with Lovable, Cursor, Bolt, and more.
Read storyStop manually retesting your app. Automatic security testing that catches vulnerabilities in AI-generated code before users do. Works with Lovable, Cursor, Bolt, and more.
Read storyReplit's instant deploy is magical - and magically hides exposed keys, missing auth, and injection-ready endpoints.
Read story