Story perspectives

380K Vibe-Coded Apps Reveal Secrets, Vulnerabilities, Phishing

5/9/2026

Summary

RedAccess Exposes Data

RedAccess reported that 380,000 publicly accessible vibe-coded assets were found online, including about 5,000 containing sensitive corporate information.
RedAccess identified phishing sites built on Lovable that impersonated Bank of America, FedEx, Trader Joe’s and McDonald’s.
Privacy defaults on several vibe-coding platforms keep apps public unless users switch them private, allowing search-engine indexing.
Escape.tech’s October 2025 scan of 5,600 vibe-coded apps uncovered over 2,000 high-impact vulnerabilities, 400+ exposed secrets and 175 personal-data exposures.

Summary

CISOs Harden Security

CISOs should scan DNS and certificate-transparency of Lovable, Replit, Base44 and Netlify subdomains.
Authentication must require SSO/SAML before deployment and block unauthenticated apps from internal data.
Zero coverage is solved by mandating SAST and DAST scans and extending the AppSec pipeline.
DLP rules should add the Lovable, Replit, Base44 and Netlify domains.
Governance should enforce an AI usage policy with shadow-AI audits and a review gate for AI coding tools.

Summary

Wix Patches Bypass

Wix’s security team patched a Base44 authentication bypass that let anyone create a verified account on private apps using only a visible app_id, within 24 hours of its disclosure.
RedAccess warned Replit CEO Amjad Masad only 24 hours before the findings went public.
Lovable contested the CVE-2025-48757 classification, arguing customers, not the platform, must protect data.
The CVE recorded missing row-level security in Lovable-generated Supabase projects, affecting data in over 170 production applications.

1 of 3

RedAccess Exposes Data

RedAccess reported that 380,000 publicly accessible vibe-coded assets were found online, including about 5,000 containing sensitive corporate information.
RedAccess identified phishing sites built on Lovable that impersonated Bank of America, FedEx, Trader Joe’s and McDonald’s.
Privacy defaults on several vibe-coding platforms keep apps public unless users switch them private, allowing search-engine indexing.
Escape.tech’s October 2025 scan of 5,600 vibe-coded apps uncovered over 2,000 high-impact vulnerabilities, 400+ exposed secrets and 175 personal-data exposures.

1 / 3