We scanned 100 vibe-coded apps — here's what we found
Over three months, Sayver scanned 100 publicly accessible web applications that were identified by their founders as having been built primarily with AI coding tools — Lovable, Bolt, v0, Cursor, or similar. Each app was scanned using three methods: a site scanner that checks live HTTP responses for missing headers, misconfigurations, and exposed credentials; a code scanner that analyzed connected GitHub repositories for SAST vulnerabilities, secrets in code, and insecure patterns; and a runtime monitor that analyzed a sample of actual traffic for signs of attack or unusual behavior. A finding was counted when it met the tool's threshold for that check and was confirmed by manual review to not be a false positive. The goal was not to shame any specific app but to produce an accurate picture of where AI-built apps consistently fall short on security.
The five most common findings, by frequency across all 100 apps, were: missing security headers (94 of 100 apps); no Content Security Policy (89 of 100); Supabase anon key or service role key present in the client-side JavaScript bundle (71 of 100, with 12 of those being service role keys, which should never be in the client); no Row Level Security on at least one database table (68 of 100 Supabase-backed apps); and no rate limiting on authentication endpoints (61 of 100). These are not obscure edge cases — they are the baseline security controls that any production application is expected to have, and the majority of AI-built apps in the sample were missing most of them.
The severity distribution told a sharper story. Across all 100 apps, the average number of findings per app was 11.4. The average number of high or critical findings per app was 2.9, meaning nearly every app had at least two findings that posed a significant risk to user data or application integrity. One in four apps had at least one critical finding — most commonly a Supabase service role key accessible to the browser, or RLS fully disabled on a table containing personally identifiable information. Seven apps had findings that, if exploited, would result in complete compromise of all user data without any authentication required.
The patterns differed somewhat by tool. Apps built with Lovable had the highest rate of Supabase anon key exposure (82%) and the lowest rate of security headers (only 4% had even basic headers configured). Apps built with Bolt had a higher rate of code-level vulnerabilities — unparameterized SQL queries, hardcoded secrets in source files — because Bolt generates more custom backend code than Lovable. Apps built with v0 and iterated in Cursor had the best overall security posture of the three, with a 54% rate of at least some security headers configured, but still had significant gaps in database access control. AI tools that scaffold authentication using a framework like Clerk or Supabase Auth had materially better auth-layer security than those that implemented custom auth — the framework handles the hard parts, and the AI tool just has to connect to it.
The apps in the sample with the best overall security posture had three things in common regardless of which AI tool built them. They had all been run through at least one automated security scanner before or shortly after launch, so they had a baseline inventory of what was wrong. They had Row Level Security enabled from the start of the project, which suggests the founder was aware of it before the AI started generating database code. And they had error monitoring (Sentry, Datadog, or similar) set up on day one, which gave them visibility into how their app was behaving in production.
To benchmark your own app against these numbers, run a Sayver scan from your public URL. The site scanner takes under 60 seconds and checks for the five most common categories from this report — headers, exposed keys, DNS and email security, authentication, and rate limiting. A clean scan does not mean your app has no vulnerabilities, but it means you have closed the most common ones. A scan with findings gives you a prioritized list of what to fix, with plain-English explanations you can paste directly into your AI builder to get working fixes.