{"id":49939,"date":"2026-11-02T19:07:32","date_gmt":"2026-11-02T13:37:32","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49939"},"modified":"2026-11-02T19:09:08","modified_gmt":"2026-11-02T13:39:08","slug":"vibe-coding-security","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/security-audit\/vibe-coding-security\/","title":{"rendered":"Vibe Coding Security Under Test: 100+ Vulnerabilities Across Four AI-Built Apps"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>TL;DR<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Astra\u2019s <a href=\"https:\/\/www.getastra.com\/reports\/vibe-coding-security-risks-study\" target=\"_blank\" rel=\"noreferrer noopener\">Vibe Coding Security Risks Study<\/a> is now live.<\/li>\n\n\n\n<li>Four AI coding platforms (Emergent, Lovable, Replit, Base44) were asked to build a FastAPI user-management microservice from one identical, security-explicit prompt.<\/li>\n\n\n\n<li>We ran our autonomous pentest agents against those builds and surfaced 100+ confirmed, exploitable vibe coding security vulnerabilities.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.getastra.com\/reports\/vibe-coding-security-risks-study\" target=\"_blank\" rel=\"noreferrer noopener\">Grab the full report<\/a> for the methodology, the per-platform severity splits, the hardening prompt, the CWE mapping, and the fixes.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Vibe-coding platforms let you go from prompt to a deployed app in a single session, a pace that outpaces the review cycles most teams built for slower releases. With Lovable nearing 8 million users by late 2025, and Replit past 50 million by April 2026, we wanted to answer a sharper question than \u201cis vibe coding safe?\u201d&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Does the platform generating the code change the outcome, and does one security prompt give you the same security everywhere? So we gave four of the most-used vibe-coding platforms (Emergent, Lovable, Replit, Base44) one identical, security-explicit prompt.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It described a FastAPI\/Python microservice with bcrypt, JWT access and refresh tokens, Pydantic v2 validation, parameterised queries, slowapi rate limiting, configurable CORS, a four-tier role model, Okta OIDC, and a Slack webhook.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each app shipped a build, our autonomous pentest went to work, and 100+ confirmed, exploitable vulnerabilities later, the results seemed more consistent than the code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.getastra.com\/reports\/vibe-coding-security-risks-study\" target=\"_blank\" rel=\"noreferrer noopener\">full report<\/a>, <em>The Security Risks with Vibe Coding: A Study<\/em>, is live now, along with companion write-ups on the <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/cors-misconfiguration\/\" target=\"_blank\" rel=\"noreferrer noopener\">CORS misconfiguration<\/a> that turned up in every app we tested and the <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/replit-security\/\" target=\"_blank\" rel=\"noreferrer noopener\">Replit-built app<\/a> that carried its share of the findings. This post walks through what the research actually says and what to do about it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Whats_in_the_Vibe_Coding_Security_Risks_Study\"><\/span>What\u2019s in the Vibe Coding Security Risks Study<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1875\" height=\"985\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/144c90d4-01-hero-vibe-coding.png\" alt=\"vibe coding security cost\" class=\"wp-image-49940\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/144c90d4-01-hero-vibe-coding.png 1875w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/144c90d4-01-hero-vibe-coding.png 1536w\" sizes=\"auto, (max-width: 1875px) 100vw, 1875px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The report is built to be used rather than skimmed. Every finding carries a CWE mapping, a reproduction path, and a fix at the layer where the control actually belongs. In full, the report contains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>100+ confirmed, exploitable vulnerabilities<\/strong> across four AI-built applications, each identified by our autonomous pentest agents, retested by a validator agent, and reviewed by a human security engineer before we counted it.<\/li>\n\n\n\n<li><strong>The per-platform severity split<\/strong>, with the Critical, High, Medium, and Low breakdowns across 9 vulnerability classes for each of the four builds, so you can see exactly which platform\u2019s app shipped which class of risk.<\/li>\n\n\n\n<li><strong>The hardened security prompt<\/strong>, written to be pasted as the first message to any vibe-coding tool, with exact thresholds for rate limiting, enumeration prevention, CSP, cookie flags, JWT revocation, row-level authorization, and audit logging.<\/li>\n\n\n\n<li><strong>The universal 10-minute browser-only checklist<\/strong> for rate limiting, enumeration, security headers, auth-required routes, and CORS lockdown. The appendix adds per-platform checks for Lovable, Replit, Emergent, and Base44 covering the confirmed blind spots in each build.<\/li>\n\n\n\n<li><strong>The four pressure points<\/strong> we found moved risk the most across platforms: prompt specificity, finding volume versus severity, access control enforcement, and fix complexity.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_you_should_trust_this_AI_code_security_study\"><\/span>Why you should trust this AI code security study<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The methodology was built to close off every usual objection to AI-generated-code critiques (cherry-picked examples, biased pentesters, vendor relationships, prompts rephrased after the fact), before the first scan began.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>One identical prompt used across four platforms without any advance notice to vendors (Emergent\u2019s paid-tier use is disclosed in Section 3 of the report)<\/li>\n\n\n\n<li><strong>Three coordinated AI agents<\/strong> (Structured Pentest, Bug Bounty Hunter, Validator) attacked each app in parallel, followed by human review. Nothing counted until it cleared the exploitability bar defined in Section 5.4 of the report, which requires reproducible evidence of real impact.<\/li>\n\n\n\n<li>A human security engineer validated every finding the autonomous pentest produced, confirming reproducibility and exploitability.<\/li>\n\n\n\n<li>We filtered out false positives and unconfirmed findings before the statistics.<\/li>\n\n\n\n<li>Pattern identification was done after the fact, with no predetermined list.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"A_glimpse_at_what_the_pentest_found\"><\/span>A glimpse at what the pentest found<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The gaps the generators left behind were more consistent than the code they shipped. Nine CWE-mapped vulnerability classes account for most of the 100+ confirmed findings, and five of those classes appeared in every build, regardless of the stack, framework, or auth strategy the generator chose.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1875\" height=\"1172\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/c4a13847-02-universal-failures.png\" alt=\"\" class=\"wp-image-49941\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/storage.googleapis.com\/cdn-blog.getastra.com\/2026\/11\/c4a13847-02-universal-failures.png 1875w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/storage.googleapis.com\/cdn-blog.getastra.com\/2026\/11\/c4a13847-02-universal-failures.png 1536w\" sizes=\"auto, (max-width: 1875px) 100vw, 1875px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">CORS misconfiguration was the single most common finding across all four apps, and one platform\u2019s build alone accounted for more than half of those instances. Every app in the study reflected arbitrary request origins back in <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Reference\/Headers\/Access-Control-Allow-Origin\" target=\"_blank\" rel=\"noopener\">Access-Control-Allow-Origin<\/a> while allowing credentials, a configuration that lets any external website make authenticated requests on behalf of a logged-in user and read the response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Broken access control was the most severe category whenever it appeared, and one platform shipped a BOLA that exposed hundreds of user profiles to any authenticated account. The report lays out which platform, how many profiles, and the exact Critical-severity chain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A typical attack chain in the study looked like this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>CORS was configured with a reflected origin, so the API echoed any Origin header back as allowed.<\/li>\n\n\n\n<li>The API accepted credentials alongside that reflected origin, so an attacker\u2019s page could send authenticated requests from any origin and read what came back.<\/li>\n\n\n\n<li>Authorization lived in the frontend React component, so hitting the API with the victim\u2019s session cookie returned data for any user ID in the request path.<\/li>\n\n\n\n<li>No rate limit on that endpoint meant the attacker could enumerate every account on the platform in minutes.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Each of those findings would be filed as medium or low on its own, which is how most scanner tools would categorize them. Chained together, they hand over the user table. The report shows the full chain for every multi-stage finding so you can see what an attacker could actually reach, not only what each individual control missed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Who_this_Report_is_for\"><\/span>Who this Report is for<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Founders and CTOs shipping vibe-coded applications<\/strong> will find the hardened prompt and the universal 10-minute checklist most useful. Both are designed to be used before launch, and both close the universal patterns without needing a security background to run.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security teams reviewing AI-generated code security<\/strong> will find the methodology and the finding-level evidence worth reading. The three-agent pipeline (Structured Pentest, Bug Bounty Hunter, Validator) plus human review is the same pipeline Astra runs against production customer applications, and the chain-of-evidence standard is the same one every AP finding has to clear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pentesters and researchers<\/strong> will find the per-platform appendix and the CWE-mapped class breakdown useful as a reference point for what AI-coded applications look like under real test conditions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"So_is_vibe_coding_safe_and_which_platform_is_safest\"><\/span>So, is vibe coding safe, and which platform is safest?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1875\" height=\"1172\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/11\/7e6f4764-03-severity-breakdown.png\" alt=\"\" class=\"wp-image-49942\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/storage.googleapis.com\/cdn-blog.getastra.com\/2026\/11\/7e6f4764-03-severity-breakdown.png 1875w, \/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/storage.googleapis.com\/cdn-blog.getastra.com\/2026\/11\/7e6f4764-03-severity-breakdown.png 1536w\" sizes=\"auto, (max-width: 1875px) 100vw, 1875px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Both questions get a cleaner answer inside the report than they will inside a blog post. The study was designed to measure how four platforms responded to the same security-explicit prompt under an identical autonomous pentest, with raw finding counts flattening too much of the per-platform context (severity distribution, CWE class, exploit chain depth, reproduction cost) to stand on their own as a ranking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The frame worth taking away is this. Vibe coding security sits at three layers that compound: the prompt specification (what controls you asked for, with thresholds attached), the generated implementation (whether the control landed at the middleware, the data layer, or only in the UI), and the post-generation verification (whether anyone tested the running app before it shipped).&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A failure at any one of these layers produces exploitable findings regardless of which platform generated the code, which is why five of the nine shared vulnerability classes in the study showed up in all four codebases.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The report\u2019s hardened prompt turns Layer 1 into a routine, not expert, task by replacing adjectives with numeric thresholds and named policies the generator can implement.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The universal 10-minute checklist and the per-platform appendix cover Layer 3, with the exact browser-visible checks for rate limiting, headers, auth coverage, CORS lockdown, and the confirmed blind spots unique to each build.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read it before you draw conclusions about any one platform.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Get_the_report\"><\/span>Get the report<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.getastra.com\/reports\/vibe-coding-security-risks-study\">Download the Vibe Coding Security Risks Study<\/a> \u2192 every finding, every fix, every category, no gating beyond an email.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.getastra.com\/autonomous-pentesting\">Meet Astra\u2019s Autonomous Pentest<\/a> \u2192 the engine that produced the findings, pointed at your own application instead of a demo build.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/cors-misconfiguration\/\">Read the CORS misconfiguration write-up<\/a> \u2192 the deep dive on the single most common finding across all four apps.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/replit-security\/\">Read the Replit pentest write-up<\/a> \u2192 one platform\u2019s build under independent testing, with the findings laid out in full.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR Vibe-coding platforms let you go from prompt to a deployed app in a single session, a pace that outpaces the review cycles most teams built for slower releases. With Lovable nearing 8 million users by late 2025, and Replit past 50 million by April 2026, we wanted to answer a sharper question than \u201cis &#8230; <a title=\"Vibe Coding Security Under Test: 100+ Vulnerabilities Across Four AI-Built Apps\" class=\"read-more\" href=\"https:\/\/www.getastra.com\/blog\/security-audit\/vibe-coding-security\/\" aria-label=\"Read more about Vibe Coding Security Under Test: 100+ Vulnerabilities Across Four AI-Built Apps\">Read more<\/a><\/p>\n","protected":false},"author":138,"featured_media":49947,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[340],"tags":[],"class_list":["post-49939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-audit"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/138"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49939"}],"version-history":[{"count":2,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49939\/revisions"}],"predecessor-version":[{"id":49946,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49939\/revisions\/49946"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49947"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}