Wiz Finds Common Security Risks in Vibe-Coded Apps and Offers Mitigations
Summary
Wiz Research says one in five organizations build on vibe-coding platforms and highlights risks including client-side authentication, exposed secrets, permissive database access, and public internal apps, with mitigation guidance.
Key points
- Wiz reports that one in five organizations build applications on vibe-coding platforms and says it found recurring high-impact security misconfigurations.
- Client-side password checks and predictable LocalStorage authentication flags can be inspected or bypassed; authentication and authorization should be handled on a server.
- API keys and service credentials embedded in client-side code can be exposed; the article recommends storing secrets securely and routing third-party calls through a backend.
- Overly permissive or disabled Supabase Row-Level Security policies can expose sensitive database records; Wiz recommends deny-by-default access and explicit, tested permissions.
- Wiz says it found internal tools and applications deployed publicly without authentication, including knowledge bases and chatbots containing sensitive information.
- Wiz says it shared the findings with Lovable, which created a security best-practices guide; Wiz also describes a portal query for customers to find publicly facing Lovable applications.
Article Details
- Defense Focus
- Identify and remediate security misconfigurations in vibe-coded applications, including client-side authentication and secrets, permissive database access, and publicly exposed internal applications.
- Detection Methods
- Fingerprint public-facing applications using “lovable.app” and other platform-identifying strings.
- Use the Wiz portal to identify publicly facing Lovable applications.
- Inspect client-side JavaScript for embedded passwords, API keys, service-account credentials, or database keys.
- Retrieve the Supabase OpenAPI schema and test table access; review accessible responses for sensitive fields such as email, phone, password, token, secret, IP, and address.
- Data Sources
- Publicly accessible web applications and their platform-identifying strings
- Client-side JavaScript files
- Supabase OpenAPI schemas and REST API responses
- Wiz inventory of publicly facing Lovable applications
- Rule Types
- Shell-based API scanning using curl to enumerate database tables and test access
- Platforms
- Wiz
- Lovable
- Supabase
- Defensive Actions
- Perform authentication and authorization decisions on a backend; do not ship credential-validation logic or secrets to client-side code.
- Proxy third-party API calls through a secure backend and store keys in Supabase Secrets.
- Apply deny-by-default database access policies and grant only necessary access based on authenticated user ID or role; test the policies.
- Require authentication for applications handling sensitive or internal information.
- Maintain visibility into organization-wide vibe-coded applications and ensure unauthenticated applications contain only public information.
MITRE ATT&CK
Vendors
LovablePioneering platforms like Lovable are at the forefront of this movement. They have enabled the creation of millions of applications, from simple personal tools to enterprise-grade solutions. Organizations now rely onWizAs part of our mission to identify emerging cloud and AI risks, Wiz Research investigated the security posture of applications generated by these vibe-coding platforms. Our findings were significant; we discovered a
Products
Amazon CognitoThe best way is to enforce server-side authentication with providers such as OAuth or Cognito, and to ensure AI prompts always treat client-side code as publicly exposed.LovablePioneering platforms like Lovable are at the forefront of this movement. They have enabled the creation of millions of applications, from simple personal tools to enterprise-grade solutions. Organizations now rely onOAuthThe best way is to enforce server-side authentication with providers such as OAuth or Cognito, and to ensure AI prompts always treat client-side code as publicly exposed.SupabaseThe solution is to proxy all third-party API calls through a secure backend - a role perfectly handled by Supabase Edge Functions in a Lovable application. Store your API Keys and secrets securely in Supabase Secrets,WizAs part of our mission to identify emerging cloud and AI risks, Wiz Research investigated the security posture of applications generated by these vibe-coding platforms. Our findings were significant; we discovered a