← All leaks & reports

Vibe-Code Top 10 · 2026 edition

The ten leaks to fix before you ship an AI-built app

AI tools build fast and ship these by default. Each one below comes from real checks Shippable runs, with what an attacker sees and a fix you can paste straight into Lovable, Bolt, v0, Replit or Cursor.

Patchy ticking items off a checklist on his clipboard
  1. 01Database tables anyone can readSupabase tables with Row Level Security off or too loose, readable by every visitor.critical
  2. 02Secret keys shipped to the browserSupabase service_role, Stripe, OpenAI and other secret keys sitting in your public JavaScript.critical
  3. 03Firebase databases anyone can readRealtime Database or Firestore rules that let anyone read your data with no login.critical
  4. 04File storage open to everyoneSupabase or Firebase storage buckets where anyone can list or download uploaded files.high
  5. 05.env and .git files served publiclyYour deployed site hands out its .env file or .git folder to anyone who asks.critical
  6. 06Endpoints and functions without access checksAPI routes and database functions anyone can call, relying on the frontend to keep them safe.Depends
  7. 07Sign-ups without email confirmationAnyone can create an account with an email address they don't own.medium
  8. 08Your source code published by accidentSource map files that hand anyone your original, readable code.medium
  9. 09Libraries with known vulnerabilitiesOutdated JavaScript packages in your app that have published security flaws.Depends
  10. 10Missing browser protectionsNo HTTPS redirect, no clickjacking protection, loose CORS or unprotected cookies.medium

Check your app for all ten

Paste your app's URL. Your first app is free; it's read-only and takes about a minute.

Before you push, scan your dev server instead: npx shippable-dev scan localhost:5173