Vibe Coding Security Risks: What Actually Goes Wrong
Quick answer
The real security risks of vibe coding are concentration, not exoticness: leaked API keys in client code, Row Level Security disabled or too permissive, open CORS on authenticated endpoints, and secrets in frontend env vars. They're common because the tools optimize for a working demo, and they're all fixable with scoped policies, server-side keys, and scheduled scans.
Risk 1: Leaked API keys
The model wires a provider, the key lands in a client env var or a hardcoded string, and it ships in the bundle. Anyone who views-source owns your OpenAI/Stripe/Resend bill. This is the most frequent critical finding in vibe-coded repos.
Risk 2: Broken Row Level Security
RLS is either never enabled (the AI writes client queries that need it off) or enabled with using(true) policies that make it theater. Either way, the anon key reads and writes anything. We cover the seven failure modes in detail in our RLS guide.
Risk 3: Open CORS on authenticated APIs
Access-Control-Allow-Origin: * feels harmless — until the endpoint returns user data and any website can read responses with a victim's session cookie. Scope it to your domain; it's a two-line fix.
Risk 4: Secrets in frontend env vars
VITE_ and NEXT_PUBLIC_ prefixes mean 'ship this to every visitor.' The fix is architectural: anything sensitive moves behind a server function. If the browser can read it, assume attackers can.
Why these patterns repeat
None of this is the builder's fault — the tools are optimized for speed-to-demo, and security review isn't part of the demo. The pattern that fixes it: automated scanning on every change, human-approved fixes, scheduled rescans for drift. Security that doesn't depend on remembering.
StackShield scans for exactly these four risks across Supabase, GitHub, and Vercel, then drafts the fixes for your approval. See what it finds in your app — the first scan is free.
Run a free scan