We Scanned 87 Public Repos Scaffolded by Lovable, v0, Bolt, and Base44. 42% to 76% Had a Critical Finding.
The Vibe Security Index is live: 87 public repositories carrying the scaffold markers of four AI app builders, scanned with 212 deterministic rules and published as per-builder aggregates anyone can re-run. The range depends on the builder — and on a counting decision that nearly produced a much scarier, much less honest number.
How to Secure AI-Generated Code: A Practical Checklist
AI assistants like Cursor, Bolt, Lovable, and Replit ship the same seven vulnerability classes — hardcoded secrets, NEXT_PUBLIC_ leaks, unverified webhooks, SQL injection, missing auth, CORS-with-credentials, and unsanitized HTML. Here's why each one happens, and a concrete grep, prompt, or habit to catch it before you deploy.
Why Your AI Wrote ALLOWED_HOSTS = ['*'] — and How That One Line Hands Over Your Django App
It passes every test, the site loads, the DisallowedHost errors stop — and it quietly turns off one of the few server-side checks Django ships on by default. The Host-header attacks the wildcard enables (password-reset poisoning, cache poisoning, SSRF), and the env-driven fix.
Your NEXT_PUBLIC_ Env Var Is Shipping Your Secret Key to the Browser
Everyone worries about committing a .env file. The leak I actually find in AI-generated Next.js apps is quieter: a NEXT_PUBLIC_ prefix on a key that should never reach the client, baked into the JavaScript every visitor downloads. How it happens, how to find it in 60 seconds, and the one-rule fix.
Why We Don't Fully Trust Our Own Benchmark
Our scanner catches 97.2% of the labeled vulnerabilities in our own benchmark, at 86.3% reviewed precision (Nov 3, 2026 hand review, updated Nov 4).
I Scanned 42 Public SaaS Startup Repos. 83% Had Hardcoded-Secret Patterns.
We didn't check whether any match is a live key, and the noise itself is the story. What 42 well-known OSS SaaS repos taught me about how AKIA patterns spread through codebases, and why even an AI-filtered scanner still produces 1,355 findings to triage.
We Ran Semgrep Against Our Benchmark. It Missed Half the Bugs.
A dated April 2026 head-to-head on a 26-fixture labeled corpus of AI-generated code. Semgrep's community rules scored 62.5% F1 then; our own /benchmark (Nov 3, 2026) has them at 20.7% F1.
The CORS Misconfiguration AI Assistants Can Generate That Exposes Your API
AI coding assistants can produce a CORS configuration that reflects every origin with credentials. Any website the victim visits can silently read their authenticated API responses.
Why Traditional SAST Tools Can Miss Bugs in AI-Generated Code
Traditional SAST tools were built for hand-written enterprise code. Here's why they can miss the bugs AI coding assistants ship — with our published Semgrep benchmark numbers.
The $10,000 Stripe Webhook Bug Hiding in AI-Generated Code
A walkthrough of a Stripe webhook vulnerability that shows up in AI-generated code — and the few lines that fix it.
I Scanned a Sample AI-Style SaaS App. Here's What It Found.
What XploitScan flagged in a sample SaaS app built to resemble typical AI-generated code: the categories that fired, an example finding, and how to fix them.
Why AI-Generated Code Is Insecure (And What You Can Do About It)
A 2025 Veracode study found 45% of AI-generated code samples failed security tests. Learn what AI coding tools get wrong and how to protect your app before you ship.