Vibe coding exposes 5,000 apps with sensitive data, as security vulnerabilities surge

RedAccess Uncovers Massive Security Vulnerabilities in Vibe Coding Platforms

Cybersecurity firm RedAccess has exposed a troubling reality about vibe coding: thousands of AI-generated applications are leaking sensitive data directly onto the open web. Security researcher Dor Zvi led a team that identified 5,000 vibe-coded web applications created using Lovable, Replit, Base44, and Netlify that had "virtually no security or authentication of any kind" 1

1

. The broader scope is even more alarming. RedAccess discovered 380,000 publicly accessible assets, including applications, databases, and related infrastructure, built with these vibe coding tools 2

2

. These findings represent one of the most significant security vulnerabilities emerging from the democratization of app development.

Sensitive Data Exposure Affects Medical and Financial Records

The scale of sensitive data exposure is staggering. In 40% of cases, the apps exposed medical data, financial information, corporate presentations, strategy documents, and conversations customers had with chatbots 1

1

. Among verified exposures were patient records from a children's long-term care facility, hospital doctor-patient summaries, and incident response records at a security company. A shipping company app detailed which vessels were expected at which ports, while an internal health company application listed active clinical trials across the U.K. 2

2

. Full, unredacted customer service conversations for a British cabinet supplier sat on the open web, and internal financial information for a Brazilian bank was accessible to anyone who found the URL. Depending on jurisdiction, these healthcare and financial exposures may trigger regulatory obligations under HIPAA, UK GDPR, or Brazil's LGPD.

Shadow AI Creates New Cybersecurity Risks for Enterprises

The vibe coding exposure is not a separate problem from shadow AI—it is shadow AI's production layer 2

2

. IBM's 2025 Cost of a Data Breach Report found that 20% of organizations experienced breaches linked to shadow AI, with those incidents adding $670,000 to the average breach cost, pushing the shadow AI breach average to $4.63 million. Among organizations that reported AI-related breaches, 97% lacked proper access controls, and 63% of breached organizations had no AI governance policy in place. Shadow AI breaches disproportionately exposed customer personally identifiable information at 65%, compared to 53% across all breaches. Most enterprise security programs were built to protect servers, endpoints, and cloud accounts—none were built to find a customer intake form that a product manager vibe coded over a weekend and deployed on a public URL indexed by Google 2

2

.

Citizen-Built Applications Bypass Traditional Security Checks

"Anyone from your company at any moment can generate an app, and this is not going through any development cycle or any security check," Zvi explained. "People can just start using it in production without asking anyone. And they do" 3

3

. Security researchers point to a fundamental gap in how prompt-to-app approaches enable non-technical users to create software. Joel Margolis outlined the issue: "Somebody from a marketing team wants to create a website. They're not an engineer and they probably have little to no security background or knowledge," adding that unless these tools are asked to create secure applications "they're not going to go out of their way to do that" 1

1

. Privacy settings on several vibe coding platforms make apps publicly accessible unless users manually switch them to private, and many of these applications get indexed by Google and other search engines.

Gartner Forecasts 2,500% Increase in Software Defects

This is not an isolated finding. In October 2025, Escape.tech scanned 5,600 publicly available vibe-coded applications and found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets including API keys and access tokens, and 175 instances of personal data exposure containing medical records and bank account numbers 2

2

. Every vulnerability Escape found was in a live production system, discoverable within hours. Gartner's "Predicts 2026" report forecasts that by 2028, prompt-to-app approaches adopted by citizen developers will increase software defects by 2,500%. Gartner identifies a new class of defect where AI-generated code is syntactically correct but lacks awareness of broader system architecture and nuanced business rules.

Platform Responses and Corporate Accountability

The vibe coding platforms' response to the revelations has been defensive. Blake Brodie, a spokesperson for Wix, the owner of Base44, told Axios that RedAccess "deliberately withheld the URLs that would have allowed us to identify and examine the applications in question" and that the allegedly exposed applications had been "deliberately set to public by their owners" 1

1

. A Lovable spokesperson stated, "It's also worth noting that Lovable gives builders the tools to build securely, but how an app is configured is ultimately the creator's responsibility" 3

3

. Netlify ignored the findings completely. CISOs now face a critical decision: treat this as a policy problem or as an architecture problem requiring discovery scanning across vibe coding domains, pre-deployment security review, and extended AppSec pipelines to citizen-built applications 2

2

.