Experts analyzed a large array of applications created using AI-based vibecoding services such as Lovable, Replit, Base44, and Netlify, and came to disappointing conclusions about security risks.
Experts analyzed a large array of applications created using AI-based vibecoding services such as Lovable, Replit, Base44, and Netlify, and came to disappointing conclusions about security risks.
According to Wired, security researcher Dor Zvi and his RedAccess cybersecurity team analyzed thousands of web applications written using so-called vibecoding.
It turned out that over 5,000 of the analyzed applications had virtually no security or authentication.
«Many of these web applications allowed anyone who simply found their web address to access both the applications themselves and their users’ data. Others had only minor barriers to such access, such as requiring the visitor to log in using any email address. About 40% of the applications exposed sensitive data, including medical information, financial data, corporate and strategic documents, and detailed logs of customers’ conversations with chatbots,» the publication writes about the results of the cyber experts’ study.
At the same time, about 2,000 of the analyzed applications created by popular vibecoding services revealed confidential data — for example, personal information of doctors, complete logs of chatbot conversations with customers, names and contact information of customers, and more.
In the case of Lovable, Dor Zvi also claims that the service was used to create numerous phishing sites that «mimicked» the sites of well-known brands and corporations, including Bank of America, Costco, FedEx, and McDonald’s.
Wired reached out to the aforementioned wiki-coding services for comment on RedAccess' findings. Netlify did not respond to a request for comment, while the three other companies denied the researchers' claims, saying they were not given enough time to respond. However, they did not deny that the web applications found by RedAccess remained unprotected.
«The main complaint with RedAccess is that some users have published applications that were supposed to be private on the open internet. Replit allows users to choose whether applications are public or private. Privacy settings can be changed at any time with a click of the mouse,» Replit CEO Amjad Masad wrote in his response to X.
In turn, a Lovable spokesperson responded that «Lovable takes reports of data breaches and phishing sites seriously, and is actively working to obtain the necessary information for investigation.» At the same time, they reminded that they provide developers with security tools, but how the app is configured is ultimately the responsibility of the developer.
Base44's parent company, Wix, said that «Base44 provides users with robust tools to configure the security of their own applications, including access controls and visibility settings.» However, it called such vulnerabilities a user configuration choice, not a problem with the platform itself.
Recall that in February, the term «vibecoding» celebrated its first anniversary.
Meanwhile, the creator of Claude Code is annoyed by the term «vibecoding.» He’s looking for a new name for AI programming and is asking the community for help.
