The canonical cautionary tale, live-tweeted as it happened.
leo: 'guys, I'm under attack'
Leo (Enrichlead) Mar 2025
Open x.com →AI tools routinely ship apps with API keys in the frontend and database security (like Supabase Row Level Security) switched off; scans found roughly 1 in 10 vibe-coded apps leaking credentials. The fixes are boring and learnable: keep secrets out of client code, turn on RLS for every table, run your platform's built-in security scanner before launch, and never announce 'I built this with zero code' until you have. Real casualties (Enrichlead, Moltbook) show attackers actively hunt vibe-coded apps.
19 resources.
The canonical cautionary tale, live-tweeted as it happened.
Leo (Enrichlead) Mar 2025
Open x.com →Top security researchers dissect the biggest vibe-coded breach yet.
Wiz Research Feb 2026
Open wiz.io →The mainstream account of what unreviewed AI code cost.
Fortune Feb 2026
Open fortune.com →The most practical pre-launch checklist written for non-engineers.
Aikido Security 2025
Open aikido.dev →First-party guide to the built-in scanners and what they catch.
Lovable 2025
Open lovable.dev →The scan data plus engineers explaining exactly how leaks happen.
Hacker News Jan 2026
Open news.ycombinator.com →Step-by-step hardening you can do without an engineer.
Fencer 2025
Open fencer.dev →Based on an audit that found 10.3% of Lovable apps leaking data.
HackNope Dec 2025
Open hacknope.com →Compares the scanners that check your app automatically.
Vibe App Scanner 2026
Open vibeappscanner.com →An independent bake-off, not vendor claims.
DEV Community (solobillions) 2026
Open dev.to →The security-industry read on the breach mechanics.
Infosecurity Magazine Feb 2026
Open infosecurity-magazine.com →The full Enrichlead post-mortem with the lessons spelled out.
Pivot to AI Mar 2025
Open pivot-to-ai.com →Builders sharing which mistakes they personally shipped.
Indie Hackers Mar 2025
Open indiehackers.com →The vulnerability stats behind the anecdotes.
Autonoma 2025
Open getautonoma.com →A roundup of early incidents and the patterns they share.
Tech Startups Mar 2025
Open techstartups.com →Fresh scan data on how many live apps still have RLS off.
SupaExplorer Jan 2026
Open supaexplorer.com →Security, scaling, and survival tactics in one founder-level doc.
ShareUHack 2026
Open shareuhack.com →A vibe-coding platform's own pre-launch warnings.
Creatr 2026
Open getcreatr.com →One dashboard that scans AI-generated code, secrets, and dependencies.
Aikido 2025
Open aikido.dev →The same ground, over in Build the product, our Starting Up track.