We Scanned 1,215 Vibe-Coded Apps. 39% of the Ones on Supabase Were Leaking Data.
Original, first-party data from real AI-built web applications. All figures are computed from our own scan results and frozen to the stated window, not borrowed from other reports.
The one-line finding
Of 359 AI-built web apps that use Supabase, 141 (39.3%) had at least one row-level-security or data-exposure problem that let information be read without authorization. Across all 1,215 apps scanned, 10.4% exposed at least one critical issue and 31.1% had a critical or high-severity issue.
What we looked at
Between December 17, 2025 and August 4, 2026, Vibe App Scanner ran 1,215 security scans across 1,119 distinct web applications, all built quickly with AI coding tools like Lovable, Bolt, v0, Cursor and Replit. We recorded 10,571 security findings, excluding SEO and accessibility checks.
These are apps their owners submitted for scanning, so the sample skews toward people already worried enough to check. It over-represents problems relative to all AI-built apps, not under. And 83% of the scans were quick scans that run a reduced set of checks, so a missing finding does not mean an app is clean. Every prevalence number below is a floor, not a ceiling.
The headline numbers
| Metric | Result |
|---|---|
| Apps scanned | 1,215 (1,119 distinct domains) |
| Security findings recorded | 10,571 |
| Apps with at least one critical issue | 10.4% |
| Apps with a critical or high issue | 31.1% |
| Apps using Supabase | 29.5% (359) |
| Supabase apps with an RLS / exposure finding | 39.3% (141 of 359) |
The most common critical exposures
Ranked by share of all 1,215 apps:
| Finding | Share of apps | What it means |
|---|---|---|
| Exposed secret | 5.4% | An API key or credential shipped in client code or a response |
| Unprotected Supabase RPC | 5.0% | A database function callable by anyone, no auth required |
| Missing INSERT policy (Supabase) | 3.1% | Anyone can write rows to a table |
| Unprotected edge function | 1.0% | A serverless function callable without authentication |
| CORS credentials with origin reflection | 0.6% | Any website can make authenticated requests on a user's behalf |
| Firestore open write | 0.5% | Anyone can write to the database |
| IDOR (broken object-level auth) | 0.3% | One user can read another user's records |
The Supabase problem, specifically
Supabase is the most common backend in the AI-built apps we see (29.5% of scans), and it is where the most serious issues cluster. The pattern is almost always the same: the app relies on row-level security to keep users' data private, but the policies are missing, disabled, or too broad.
The single most common Supabase issue is a publicly readable table (9.8% of all apps, high severity): a table that returns rows to an unauthenticated request. Close behind are unprotected database functions (5.0%) and missing write policies (3.1%).
A subtler and more dangerous variant: policies written as "allow any authenticated user" rather than "allow the row's owner." On an app that also enables anonymous sign-ins, "authenticated" means anyone, because a visitor can create a session with no account. Data that looks protected is effectively public.
Almost everyone is missing basic headers
Beyond the critical issues, security-header hygiene is nearly universal as a gap. 93.6% of apps were missing a Cross-Origin-Resource-Policy header, 78.4% were missing a Content-Security-Policy, and 70.6% were missing X-Frame-Options. These are low and medium severity on their own, but they are often the difference between a mistake being contained and being exploitable.
Why AI-built apps land here
The tools that generate these apps are good at producing working features fast. They are not good at the parts security depends on: scoping a database policy to the right owner, keeping a service key out of the client bundle, turning off an introspection endpoint. Speed multiplies small defaults, and the defaults are rarely safe. The finding distribution above is what that looks like at scale.
Methodology and limitations
- Source: Vibe App Scanner's own scan results. First-party data, not aggregated from other vendors.
- Window: December 17, 2025 to August 4, 2026. Figures are frozen to this window.
- Denominator: 1,215 scans across 1,119 distinct domains.
- Sample bias: apps voluntarily submitted for scanning, which skews toward owners who suspected a problem. Results over-represent issues versus the general population of AI-built apps.
- Floor, not ceiling: 1,007 of 1,215 scans were quick scans running a reduced check set, so every percentage is a lower bound.
- Backend detection: the Supabase cohort was identified from technologies detected during the scan, not self-reported.
See where your app lands
vas checks for every issue in this report and more. Run your first scan free to see your security score and issue counts in minutes. Unlock every finding with a copy-paste fix from $19/month.
Cite this study
If you reference these numbers, please attribute to Vibe App Scanner (vibeappscanner.com), 2026, and link back so readers can see the methodology. We update the dataset periodically and date each revision.