Innovation or Negligence? The Dark Side of the "Vibe Coding" Wave
Security researchers at RedAccess scanned hundreds of thousands of apps built on vibe coding platforms like Lovable, Replit, and Base44. What they found should worry anyone shipping software without a security review.
Innovation or Negligence? The Dark Side of the "Vibe Coding" Wave
I said this months ago. I warned people that it would happen.
Now, we finally have the hard numbers.
Security researchers at RedAccess recently ran a massive scan on applications built using popular, instant "vibe coding" platforms like Lovable, Replit, and Base44. What they uncovered honestly sounds like a dystopian piece of fiction.
But it is completely real.
The Terrifying Reality by the Numbers
The researchers discovered 380,000 applications completely exposed to the open internet.
Out of those, more than 5,000 platforms were actively leaking deeply sensitive, real-world data. This isn't just placeholder text; it is high-stakes data left out in the open:
- Private medical data: A British healthcare app left a list of active clinical trials and patient details completely visible online.
- Global logistics: A shipping company's app exposed live, real-time port schedules for massive cargo ships.
- Corporate secrets: Uncensored customer service chat logs and internal business strategy documents were sitting on the public web.
There was no login screen. No password required. No data permissions enforced. Nothing. Anyone with the URL could see everything.
RedAccess reported that roughly 380,000 vibe-coded assets were publicly accessible across platforms including Lovable, Replit, Base44, and Netlify. Axios and WIRED independently verified examples from the findings in May 2026.
Why Did This Happen?
It happened because the barrier to building software has dropped to zero. Someone who has never written a single line of traditional code can now sit down and build a fully functional application in minutes.
They can build something that looks beautiful on the outside without having a single clue how identity verification or data restriction works. They don't know what database security rules — like Supabase Row Level Security (RLS) — even are, and there is no engineering team reviewing their work before it goes live.
The study highlighted two massive red flags:
- 91.5% of the analyzed applications contained active, plug-and-play security flaws.
- 96% of the most critical vulnerabilities were simply basic security settings that were never switched on.
This isn't a highly sophisticated cyberattack. It's not a brilliant exploit. It's the digital equivalent of building a state-of-the-art bank vault and forgetting to lock the front door.
"It Works" Does Not Mean "It's Secure"
This isn't a failure of technology. The tools are doing exactly what they were designed to do: they turn a prompt into a working application. This is a failure of human understanding.
Handing someone a tool that generates an entire application at the click of a button without teaching them the absolute basics of safety is like giving someone a GPS and expecting them to know how to plan an entire city's infrastructure.
We have accidentally created a culture that assumes if an application "works," it must be safe to launch.
But there are no shortcuts in security. There never have been, and there never will be. No matter how smart our building tools get, if the person behind the wheel doesn't understand the foundations of data protection, the result will always be a disaster waiting to happen.
Speed is not safety. An app that loads, looks polished, and "works" can still ship with public database access, missing login checks, and exposed API keys — all before anyone in security even knows it exists.
What Do You Think?
At Puaro, we believe in building fast — but we also believe that security cannot be an afterthought left to chance.
So let's open this up for debate: Is the "vibe coding" wave a brilliant leap forward for tech innovation, or is it just opening the floodgates to corporate negligence?
Share this post on LinkedIn and let us know your thoughts in the comments.