Symbiotic Security Labs found at least one vulnerability in 98% of 1,072 vibe-coded apps behind public Supabase URLs in an audit collected from January through March 2026. That is a warning about this specific sample—not proof that 98% of all AI-built software is vulnerable. If your app handles user data, check its access rules, credentials, authentication, and deployed configuration rather than relying on a clean scan alone.
What the 98% figure actually measures
Symbiotic Security Labs reports that automated scanning found 6,185 vulnerabilities across the 1,072 apps, an average of 5.9 per app; 29% of the reported vulnerabilities were classified as high or critical. The apps were vibe-coded and accessible behind public Supabase URLs, and the stated collection period was January–March 2026. The result does not establish the prevalence of flaws in every vibe-coded app, every Supabase project, or all AI-written software. Read Symbiotic Security Labs’ study.
As an Amazon Associate I earn from qualifying purchases.
Other audits describe different populations and findings. Escape Security reported that nearly 60% of more than 5,600 publicly available applications it assessed contained critical security flaws; it also assessed 1,280 APIs. Its report counted 34,232 vulnerabilities, more than 400 exposed secrets, and 175 instances of exposed personally identifiable information, including medical records, IBANs, phone numbers, and email addresses. Those 175 instances are not a count of affected people. Read Escape Security’s report.
Norma, part of Quality Clouds, reported at least one security finding in 87% of 424 public AI-generated projects it scanned. Those projects contained 21,632,176 lines of code and were assessed with 295 rules. In a subset of 206 Supabase-backed projects, 98% had a finding. This was repository analysis, not the same kind of deployed-app audit as Symbiotic’s; the percentages should not be treated as a direct comparison. Norma also notes limitations in independently reproducing some pipeline outputs from its published per-repository data. Read Norma / Quality Clouds’ report.
#1 Best Overall
Why permissions deserve the first check
A browser-visible backend key is not, by itself, proof that an app has been breached. The important question is what an unauthenticated or wrongly authorized visitor can do with the app’s exposed endpoints and data. Escape identifies misconfigured permissions—particularly Supabase Row-Level Security (RLS)—as a major concern. A policy must restrict records and storage to the users and roles intended by the app, not merely exist in the project settings.
Check Supabase data and storage policies
- Review RLS policies on every table containing user or application data. Confirm that a signed-in user can access only the rows the product intends them to see.
- Review storage bucket visibility and object policies. Verify that private files cannot be fetched by changing an object path or making a request without the intended authorization.
- Test both allowed and denied cases using accounts with different roles, plus a logged-out session where relevant. A policy that permits the expected request should also reject neighboring users’ records and administrative actions.
How to check whether your vibe-coded app is secure
Use automated scanning as one input, then inspect the controls that govern access and deployment. Only scan an app or repository you own or are authorized to test.
- Start with data access. In your backend project, inspect database row policies and storage access rules. For Supabase, review RLS on data-bearing tables and test with distinct user accounts; do not assume that enabling RLS alone proves each policy is correct.
- Look for secrets in code and delivered files. Review repository contents, commit history, and browser-loaded JavaScript for service-role credentials, cloud credentials, live payment keys, and other secrets. If a secret was exposed, remove it from client code and rotate it; deleting a line from the current version does not invalidate a credential already disclosed.
- Test authentication and endpoint authorization. Check that API routes, administrative functions, and GraphQL access require the right identity and role. Verify that changing an ID or resource path cannot expose another user’s data—an insecure direct object reference (IDOR) pattern.
- Review deployment and network settings. Check whether cloud storage is unintentionally public, and review TLS, security headers, CORS policy, and source-map exposure. These settings affect what an external visitor can reach or learn about the deployed app.
- Inspect dependency findings. For each flagged package, confirm the package and affected version, whether the vulnerable code is reachable in your app, and whether a fixed version is available. A scanner finding is a prompt for investigation, not automatic proof of exploitability.
- Fix in the owning project and verify. Change the relevant policy, secret handling, code, dependency, or deployment setting. Review the actual resulting configuration and retest the affected access case. Treat AI-generated remediation prompts as suggestions to verify, not as proof the repair is correct.
Choose a scan that can see the part you need to inspect
A scan of a live URL and a scan of a source repository answer different questions. Product pages describe their own capabilities; those descriptions are not independent validation that a service catches every defect.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Scan type | Input and visibility | What it can miss or require |
|---|---|---|
| Deployed URL scan | Starts with an app URL and probes what is remotely observable. VibeSafely says its checks include exposed backend/data access, secrets in loaded scripts, routes, storage, and network configuration. VibeSafely’s service description | Shows behavior available from the tested deployment, not the safety of every code path or future configuration. VibeSafely says scans are read-only and requires users to confirm they own or are authorized to test the target. |
| Repository scan | Starts with a GitHub repository. Sentrint says it checks source and history for hardcoded secrets, database access rules, dependencies, and code paths. Sentrint’s service description | A source finding may depend on whether the code is reachable and how the app is deployed. Sentrint describes read-only repository access and a single-use clone; its page does not establish that every flagged issue is exploitable. |
These are examples of the two scan modes, not a ranking or an exhaustive list of services. A URL scan can expose a risky deployed response that a source-only review may not reveal; repository analysis can find a vulnerable dependency or a secret in history that a live-site probe may not see. For a consequential app, combine appropriate code and configuration review with tests against the deployed system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What a clean scan can—and cannot—tell you
A clean result means the scanner did not report a finding within its checks, target, and conditions. It does not prove that authentication, access policies, secrets handling, or sensitive-data flows are secure. The cited services describe particular checks, but the available evidence does not establish a complete security guarantee for any of them.
VibeSafely and Sentrint describe generated fix prompts, but an automated recommendation still needs review and validation in the project. After a change, verify the relevant policy or code directly and retest with authorized accounts; a scan is most useful as part of that repair-and-check cycle.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
