Guide
The security risks of vibe coding
The main security risks of vibe coding are an open database anyone can read, secret keys shipped to the browser, and a public .env file, because AI builders leave those defaults to you and rarely warn you. All three expose real user data, and all three are fixable from your live URL once you know to look.
The risks that actually bite
- The open database. Row-level security off means the public key in your app reads every row. Attackers try this first.
- Secret keys in the browser. A service-role or live payment key in your shipped JavaScript grants full access to anyone who finds it, and automated tools scan public bundles for exactly these.
- The public .env file. Deployed as a static asset or committed to a public repo, it hands over every secret at once.
- Missing protections. No security headers, a wildcard cross-origin policy, published source maps that reveal your code.
Why vibe coding creates them
None of this is the AI being careless. It is the AI doing its job, which is to make a feature work, and leaving the security configuration to a human who often does not know it exists. The speed that makes vibe coding great is the same speed that skips the step where someone would have locked the door.
Row-level security off means the public key in your app reads every row.
How to catch them before someone else does
Every risk above is visible from the outside, because it is in what the browser downloads. That is also how attackers find them. Scan your live URL with Plaintext and you see the same openings first, worst ranked at the top, each with a fix.
Frequently asked
Is vibe coding safe?
Vibe coding is safe to build with, but the output is not secure by default. It leaves database rules, key handling, and security headers to you, so the app needs a check before real users touch it.
What is the biggest security risk when building with AI?
Leaving the database open. An AI builder connects your app to a database but does not enforce access rules, so if row-level security is off, anyone with the public key can read your data.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes vibe coding tools leave open. The first scan is free.
Scan my app