Vibe-coded website: cheap today, expensive a year later

Vibe coding means building a website or app by describing what you want to an AI tool in plain words, without reading the code yourself. Collins Dictionary named it the word of the year for 2025, and with tools such as Lovable, Bolt or v0 a booking page can be built over a weekend. For a prototype or an internal tool, that is a fast and cheap route. The risk appears when a vibe-coded website goes live and starts storing customer data, while nobody has reviewed the code and nobody watches it after launch. In a study published in June 2026, Symbiotic Security checked 1,072 such apps running on a Supabase database and found at least one security flaw in 98% of them. Below are the most common mistakes, a worked example with costs and an 8-step check for a site that is already online.

What vibe coding is and where it fits

AI researcher Andrej Karpathy coined the term in February 2025: a person describes the goal, the AI writes the code, and the person judges only whether the result on screen looks right. In November 2025 Collins Dictionary picked “vibe coding” as its word of the year. Platforms built around the idea include Lovable, Bolt.new, v0, Replit and Base44, and many of them connect a Supabase database to store data.

In our view, vibe coding works well when a mistake is cheap:

• a prototype to show an idea to an investor, colleagues or a designer;
• an internal tool that holds no customer personal data, such as a stock calculator;
• testing demand: a one-offer page you advertise for a week to see whether anyone signs up;
• a first version that a developer will later review and rebuild.

It gets harder when the prototype becomes the company website with bookings, sign-ups or payments. At that point it holds other people’s data, and the site owner is responsible for it.

What the 2025-2026 research shows

Symbiotic Security (June 2026). Researchers found 1,085 public apps built with Lovable, v0, Bolt.new, Replit and Windsurf on top of Supabase and scanned 1,072 of them without downloading any data. 1,046 apps (98%) had at least one flaw and 173 (16%) had a critical one. On 172 sites anyone could delete or change data without logging in. Exposed tables had names like “leads”, “profiles”, “payments” and “admin_users”. This is the vendor’s own research and the sample is not random, so the 98% should not be read as a figure for every vibe-coded app.

Escape.tech (October 2025). The team passively scanned more than 5,600 public apps, mostly from Lovable, Base44 and Create.xyz. They found 2,038 highly critical vulnerabilities, over 400 leaked secrets and 175 cases of exposed personal data, including medical records and IBANs. The authors call these numbers a lower bound.

Georgia Tech Vibe Security Radar (2026). Researchers at the Georgia Institute of Technology went through more than 43,000 security advisories looking for flaws introduced by AI coding tools. They counted 6 in January 2026, 15 in February and 35 in March, and March alone exceeded the whole of 2025. A Cloud Security Alliance research note adds that the researchers estimate the real number in open-source projects at 5-10 times higher.

Wiz Research (July 2025). Wiz found a flaw in the Base44 platform where knowing an app’s public identifier was enough to register on a private app. The platform fixed it in under 24 hours. Risk can sit in the platform itself, and there only the platform’s own engineers can fix it.

Seven mistakes found most often

1. Secret keys in browser code. A key for a payment provider, email service or AI API sits in a file every visitor downloads. Anyone can copy it and spend your money or read your data. Supabase’s public key may live in the browser, the secret “service_role” key never.
2. No access checks. The page hides the “Admin” button, but the server does not check who is asking for data. Changing a record number in the address is enough to see another customer’s booking.
3. Open database tables. Supabase’s documentation says a table without Row Level Security policies can be read and written by anyone with API access. The AI tool creates the table, but not always the policies.
4. No backups. Supabase’s free plan has no automatic backups, and the project is paused after a week of inactivity. If someone deletes a table, there is nothing to restore.
5. Nobody updates anything. The app depends on dozens of open-source libraries. When a vulnerability turns up in one of them, someone has to update it and check the site still works. A vibe-coded project usually has no person whose job that is.
6. Form spam. Without CAPTCHA, rate limits and email confirmation, bots fill in the form thousands of times. Symbiotic Security found open sign-up on 220 sites and email confirmation switched off on 69.
7. Personal data and GDPR. A name, phone number and reason for an appointment are personal data, and health information is a special category (GDPR Article 9). If it leaks, the controller must notify the supervisory authority within 72 hours, which in Latvia is the Data State Inspectorate, unless the breach is unlikely to put people at risk (GDPR Article 33).

A developer usually spots all seven in the first code review, and fixing them before launch takes hours.

Example: a physiotherapy practice booking page in Jelgava

A typical situation. A physiotherapy practice in Jelgava has three therapists. The owner received a quote of 1,600 € from a developer for a site with a booking form, but decided to try it herself. Over a weekend she built a page with an AI tool: services, prices and a form where the patient enters a name, a phone number and a short note on what hurts. The data went into a free Supabase project. First-year costs would be the AI tool subscription at about $25 a month and a 12 € domain, roughly 300 € in total. Savings against the quote: about 1,300 €.

Three months later the son of one patient, who works in IT, opened the browser’s developer tools and saw that the bookings table returned all 900 records to anyone who knew the API address. Names, phone numbers and notes like “knee pain after surgery” were visible without logging in. The same table also held 3,400 bot submissions.

The fix cost this much:

• developer: 14 hours at 55 €, 770 € in total (security policies, form handling moved to a server function, CAPTCHA, spam cleanup, export and backup setup);
• legal advice on notifying the Data State Inspectorate and the letter to patients: 300 €;
• Supabase Pro plan with daily backups: $25 a month;
• the receptionist took bookings by phone for 2 weeks and spent about 10 hours calling patients whose data had been exposed.

By month four, about 200 € of the 1,300 € saving was left. And the site still had no one responsible for it: the next library update or form change would again be billed by the hour.

Why it is cheap today and expensive a year later

Vibe coding cuts the cost of building a site sharply. It does not cut the work needed after launch, and nobody writes that work into the initial budget. Over a year, a site that stores customer data needs at least:

• backups you can restore, and a test that restoring actually works;
• library and platform updates, with the form checked after each one;
• monitoring that alerts you when the site is down or the form stops sending;
• spam filtering and limits on forms;
• a person who knows where the data lives and what to do within 72 hours of a leak.

From our experience with sites we take over from others, cleaning up after the fact always costs more than the same work before launch, because first someone has to understand what the code does and where the data is. That is our observation, not research data.

An 8-step check for a site built with Lovable, Bolt or v0

Only test your own site. Some steps need access to the Supabase dashboard or the code repository.

1. Keys in the browser (5 min). Open the site in Chrome, press F12, go to Sources, press Ctrl+Shift+F and search for “service_role”, “sk_live”, “secret” and “api_key”. Supabase’s public (anon or publishable) key may be visible if the tables have security policies. If you find any other secret key, rotate it in that service’s dashboard and remove it from the code.
2. Table security policies (5 min). In the Supabase dashboard open Advisors, then Security Advisor. Tables shown with RLS disabled are open. Every table with customer data must have RLS enabled and at least one policy.
3. The site through a stranger’s eyes (5 min). Open the site in a private window without logging in and watch what the database requests return in the F12 Network tab. If you see other people’s names, emails or phone numbers, the data is public.
4. Two-user test (10 min). Create two test accounts. With the second, try to open the first account’s records, for example by changing the ID in the address, and try to open the admin page. Both should be refused.
5. Forms (5 min). Submit the form ten times in a row. If all ten go through with no CAPTCHA or limit, bots will do it a thousand times. Sign-up should require email confirmation.
6. Backups (15 min). Check which Supabase plan the project is on. The free plan has no backups, so either move to Pro or export the database regularly and try a restore at least once.
7. Updates (10 min). If the code is on GitHub, switch on Dependabot alerts or run npm audit. Put in the calendar who checks the alerts and on which day each month.
8. Personal data (15 min). Check that the database is in an EU region, that the site has a privacy policy naming the right controller, how long you keep bookings, and who decides on reporting to the Data State Inspectorate if data leaks.

If any of the first four steps fails, either switch off the form or replace it with a phone number until the flaw is fixed. The other four are work for the next two weeks.

How we work

We use AI every day to write first drafts of code and copy. A designer draws the site in Figma, and a developer reads every draft and checks access rules, forms and data storage before the code reaches the server. After launch the site stays under maintenance: updates are tested on a copy of the site first, a backup is made every day and before every change, and monitoring alerts us if the site goes down. More in How we use AI in development and where we keep it out.

What to do this week

• Search the browser code for secret keys and rotate every one that should not be there.
• Check in Supabase Security Advisor that RLS is enabled on every table with customer data.
• Open the site in a private window and check the database does not return other people’s data.
• Use two test accounts to check that one user cannot see another’s records.
• Add CAPTCHA to the form and switch on email confirmation.
• Set up backups and test a restore once.
• Write down who updates the libraries and checks the form every month.

Frequently asked questions

How we review a site built with an AI tool

A site built with Lovable, Bolt, v0 or a similar tool gets the same review as a site made by another developer: access, secret keys, database policies, forms and backups. After the review you know what to fix now, how many hours it takes and whether it pays to move the site to WordPress. For WordPress sites, hosting with updates and daily backups starts at 144 € + VAT a year, and maintenance with changes at 60 € + VAT a month. See Website maintenance and Website development. Fill in the form or call +371 25 640 062.

Sources

• Symbiotic Security: We scanned 1,072 vibe-coded apps, 98% had security flaws (02.06.2026)
• Escape.tech: The State of Security of Vibe Coded Apps
• Escape.tech: How we discovered over 2k high-impact vulnerabilities in vibe-coded apps (29.10.2025)
• Georgia Tech SCP: Bad Vibes: AI-Generated Code is Vulnerable, Researchers Warn (13.04.2026)
• Cloud Security Alliance: Vibe Coding’s Security Debt: The AI-Generated CVE Surge (04.2026)
• Wiz Research: critical vulnerability in the Base44 platform (29.07.2025)
• Supabase: Row Level Security documentation
• Supabase: database backups
• CNN/CTV: “Vibe coding” named word of the year by Collins Dictionary (06.11.2025)
• General Data Protection Regulation (EU) 2016/679 (EUR-Lex)