Not our research
What keeps going wrong.
We are not the ones saying this. Below is what WIRED, The Register, Axios, CSO Online and university researchers have published about apps built with the same tools you used. Every link was opened and checked on 29 October 2026.
None of this means the tools are bad, and none of it is about anybody being careless. These tools build something that works, and the part that keeps people out is the part nobody thinks to ask for. That is the whole problem in one sentence.
What was reported
Newsrooms, writing about things that actually happened to somebody.
BleepingComputer
Over 16,000 Supabase databases expose PII, passwords, auth tokens
Researchers found more than sixteen thousand app databases that anybody could read, over half holding personal details and some holding passwords. One valet company alone had over a hundred thousand customer records open. Most were set up by AI coding tools, and the owners did not know.
WIRED
Thousands of Vibe-Coded Apps Expose Corporate and Personal Data on the Open Web
Researchers went looking through apps built with Lovable, Replit, Base44 and Netlify and found more than five thousand with no sign-in on them at all. Close to two thousand were handing out real information about real people, including medical records and customer chat logs.
Axios
Thousands of AI-built apps exposed sensitive corporate and personal data, researchers found
The same research, reported for a business audience: three hundred and eighty thousand things built with these tools were reachable by anybody, largely because they are public unless you change a setting most people never see.
The Register
Vibe coding upstart Lovable denies data leak, cites ‘intentional behavior’
A researcher showed that a free account could read other people’s code, keys and chat history. The point for a founder is not the argument that followed, it is that nobody was going to tell you while it was happening.
The Register
Lovable-hosted app littered with basic flaws exposed 18K users, researcher claims
One app. Sixteen faults, six of them serious, and eighteen thousand people’s records reachable. The sign-in had been built backwards: it let strangers in and kept the real users out.
Infosecurity Magazine
Vibe-Coded Moltbook Exposes User Data, API Keys and More
A popular app built entirely with AI tools left its whole database open. Thirty thousand email addresses could be read by anybody, along with one and a half million sign-in keys that let a stranger act as any user.
The Register
AI vibe coding: when automation convenience becomes security debt
A security engineer found that AI-written code had quietly trusted something a visitor controls. Two standard checking tools looked straight at it and saw nothing wrong.
CSO Online
Output from vibe coding tools prone to critical security flaws, study finds
Five of the best known AI building tools were tested by asking each to build something ordinary. The testers found sixty-nine separate faults across what came back.
CSO Online
When AI nukes your database: the dark side of vibe coding
A founder watched an AI assistant delete the live database of his own company after one suggested command. This is the reason we ask whether anything you have could be brought back.
What was measured
People who counted rather than reported. You will not recognise all of these names, and they are the reason the ones above are not a run of bad luck.
arXiv (academic preprint)
Understanding the (In)Security of Vibe-Coded Applications
Two hundred live apps examined by academic researchers with nothing to sell. Not yet peer reviewed, and worth reading anyway. Ninety-one in every hundred had at least one fault, and two thirds of those faults were rated serious or critical.
Georgia Tech Research
Bad Vibes: AI-Generated Code is Vulnerable, Researchers Warn
University researchers, not a security company: the same pattern of missing checks turns up again and again in what these tools produce, because the tool writes what works, not what is safe.
Escape
The state of security of vibe-coded apps
A scan of vibe-coded apps in the wild, and the closest thing to our own study. They published the numbers and not the method, which is why ours says exactly how it was run.
Cloud Security Alliance
Research note: AI-generated code vulnerability surge, 2026
An industry body counting confirmed holes traced to AI-written code, year on year. The line goes up steeply, and 2026 was three months old when they wrote it.
Veracode
2026 GenAI Code Security Report
Code written by AI was tested against known categories of mistake. Close to half of it failed, and the rate was worse for some languages than others.
So what do you do about it?
Every story above has the same shape. Something was reachable that should not have been, nobody inside the business knew, and they found out from a stranger. Not one of them was discovered by the person who built the app.
That is the entire reason this exists. Paste your address and we will tell you, in plain English, whether any of the above is true of yours. It takes about a minute, there is no sign-up, and we only look at what any visitor could already see.
We also ran our own study of fifty apps, with the method published, or see everything we look for.