Someone finally scanned 380,000 vibe-coded apps. About 5,000 were leaking medical records and bank financials.
- Date
- May 2026
- Tools involved
- Lovable, base44, Replit
- Impact
- About 5,000 of roughly 380,000 scanned apps actively leaking sensitive data; roughly 40% of vulnerable apps exposed medical, financial, or corporate records
- Root cause
- Default-public project settings on vibe-coding platforms; builders never flipped apps to private or added access controls
What happened
In early May 2026, Israeli cybersecurity startup RedAccess published findings from a scan of roughly 380,000 applications built on vibe-coding and no-code platforms including Lovable, Base44, Replit, and Netlify. The scan found thousands of apps deployed to the open web with no access controls at all: more than 2,000 holding sensitive corporate, operational, or personal data, and around 5,000 actively leaking sensitive information.
Roughly 40% of the vulnerable apps exposed data such as medical records, financial information, corporate strategy documents, and customer-service chat transcripts. Many granted admin access by default to anyone who reached the URL. The verified real-world exposures RedAccess cited read like a cross-section of the economy: a shipping company's vessel schedules, the status of UK clinical trials at a healthcare firm, internal financials from a Brazilian bank, and customer chat logs from a British furniture retailer.
The root cause RedAccess identified was structural rather than exotic. Several major vibe-coding platforms make new projects reachable by anyone with the URL unless the builder explicitly flips them to private. That step never surfaces in the typical workflow of describing the app, accepting what the AI produces, and moving on, and many of the builders are non-technical, so nobody ever flips it.
The research was covered by Axios, WIRED, VentureBeat, and The Hacker News, which examined the roughly 2,000 corporate-app subset across the roughly 380,000 publicly accessible assets. It stands as a category-defining measurement of how much data vibe-coded apps are exposing in aggregate.
Impact
The scale is the story: out of roughly 380,000 scanned apps, around 5,000 were actively leaking sensitive information and more than 2,000 held sensitive corporate, operational, or personal data with no access controls. Roughly 40% of the vulnerable apps exposed high-consequence data, including medical records, financial information, corporate strategy documents, and customer-service transcripts. The confirmed examples spanned a shipping company's vessel schedules, UK clinical trial statuses at a healthcare firm, a Brazilian bank's internal financials, and a British furniture retailer's customer chat logs, and in many cases anyone with the URL got admin access by default.
Root cause
This was not a sophisticated attack; it was a default. Several major vibe-coding platforms ship new projects public, reachable by anyone who has or guesses the URL, unless the builder explicitly switches them to private. The people building these apps are often non-technical, the describe-accept-ship workflow never surfaces the visibility setting, and the AI does not volunteer that the app it just built is readable by the entire internet. Multiply one skipped checkbox by hundreds of thousands of apps and you get about 5,000 live leaks.
How to not be this entry
- Check your project's visibility setting the day you deploy, and again after any platform migration. Assume the app is public until you have personally confirmed it is private.
- Put real authentication in front of every endpoint and admin surface. "Nobody knows the URL" is not access control; RedAccess found apps handing out admin access to anyone who arrived. Read the fix guide: No auth on your AI-generated API endpoints: anyone can call your backend
- If your app stores data in Supabase, confirm Row Level Security is enabled on every table before real user data goes in. Read the fix guide: Supabase Row Level Security is off: your whole database is readable with the anon key
- Audit your client-side code for exposed API keys and secrets; a public app plus embedded credentials compounds the leak. Read the fix guide: Lovable API key exposed: secrets visible in your client-side code
- Open your deployed app in a logged-out browser session and try to reach data and admin pages directly. If you can see it logged out, so can everyone else.
Tools that actually fix this
Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.
If your AI-built app uses Supabase, Row Level Security is the actual fix for exposed data, and it is free. The dashboard's Security Advisor lists every table you left open.
Try Supabase →Drop-in authentication that handles sessions, tokens, and protected routes properly, so you stop shipping the hand-rolled auth an AI guessed at. Generous free tier for a real app.
Try Clerk →Frequently asked questions
What did the RedAccess scan of vibe-coded apps find?
In May 2026, RedAccess scanned roughly 380,000 apps built on vibe-coding and no-code platforms including Lovable, Base44, Replit, and Netlify. It found thousands deployed with no access controls, more than 2,000 holding sensitive corporate, operational, or personal data, and around 5,000 actively leaking sensitive information, with roughly 40% of the vulnerable apps exposing data like medical records and financial information.
What kinds of data were vibe-coded apps leaking?
The RedAccess research found vibe-coded apps exposing medical records, financial information, corporate strategy documents, and customer-service chat transcripts. Verified examples included a shipping company's vessel schedules, the status of UK clinical trials at a healthcare firm, internal financials from a Brazilian bank, and customer chat logs from a British furniture retailer. Many of the exposed apps granted admin access by default to anyone who reached the URL.
Why were so many vibe-coded apps publicly exposed?
The key root cause RedAccess identified was default-public project settings: several major vibe-coding platforms make new projects reachable by anyone with the URL unless the builder explicitly flips them to private. That step never surfaces in the typical describe-it, accept-it, ship-it workflow, and many builders on these platforms are non-technical, so the setting simply never gets changed.
Which platforms were included in the RedAccess scan?
RedAccess scanned roughly 380,000 applications built on vibe-coding and no-code platforms including Lovable, Base44, Replit, and Netlify. The findings were covered by Axios, WIRED, VentureBeat, and The Hacker News, which focused on the roughly 2,000 exposed corporate apps within the larger set of publicly accessible assets.
How do I check whether my vibe-coded app is exposed?
Start with your platform's project visibility setting and confirm the app is actually private, since several vibe-coding platforms default new projects to public. Then open your app's URLs in a logged-out browser and try to reach data views and admin pages directly; if anything sensitive loads without a login, you are exposed. Finally, verify that every backend endpoint requires authentication rather than relying on the URL staying secret.
Sources
- The Hacker News: What 2,000 exposed vibe-coded apps reveal
- Security Boulevard: Thousands of vibe-coded apps exposing corporate and personal data, RedAccess finds
- PPC Land: Vibe-coded apps are exposing corporate and personal data to the open web
Related error guides
No auth on your AI-generated API endpoints: anyone can call your backend
Supabase Row Level Security is off: your whole database is readable with the anon key
Lovable Supabase RLS not enabled: anyone can read your app's data (CVE-2025-48757)
Lovable API key exposed: secrets visible in your client-side code
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.