Vibe coding tools like Cursor, Lovable, and Bolt are shipping code 10x faster. But nobody was measuring what happens when that code hits production. Until now.
Over the past weeks, vibe'nscan has analyzed 133+ repositories built with AI coding assistants. We ran deterministic security rules, antipattern detectors, and LLM-powered deep audits to produce this first-ever data-driven report on AI code security.
Here's what we found.
Key Findings
Severity Breakdown
Across all completed scans, we identified 13,992 individual findings. Here's how they break down by severity:
The vast majority of findings are high severity (65.5%), followed by medium severity (28.4%). Critical findings represent only 0.7% of all findings, but each one represents a potentially exploitable vulnerability that could lead to data breaches, unauthorized access, or service disruption.
Top Vulnerability Categories
The findings cluster around a few key categories, revealing systemic patterns in AI-generated code:
| Category | Findings | Share |
|---|---|---|
| Security | 8,007 | 57.2% |
| Antipattern | 3,920 | 28.0% |
| Twelve-Factor | 1,713 | 12.2% |
| SEO Core Web Vitals | 109 | 0.8% |
| SEO / Geo / Other | 243 | 1.7% |
Security vulnerabilities dominate at 57.2% — including exposed API keys, missing input validation, insecure authentication patterns, and hardcoded credentials. This is the single biggest risk for teams shipping AI-generated code without review.
Antipatterns (28.0%) include debugging endpoints left in production, console logging of sensitive data, and unsafe React patterns — code that works in development but creates risk in production.
Twelve-Factor violations (12.2%) cover hardcoded configuration, missing environment variable separation, and deployment-ready gaps that break when moving from local to cloud.
What This Means for Vibe Coders
AI coding assistants are phenomenal at generating code fast. But they are not security reviewers. The data above shows that every single repository scanned had security findings, with an average of over 13 issues per scan.
This doesn't mean AI-generated code is unusable. It means the workflow needs a safety layer. The teams that will win with vibe coding are the ones who treat AI output as a draft — not a deployment artifact.
Our 94 LLM-powered deep audits revealed additional context that static rules can't catch: subtle logic flaws, insecure data flow patterns, and architectural weaknesses that only emerge when the full codebase is analyzed together.
How to Protect Your Vibe-Coded Apps
- 1Run a free URL recon scan. Enter your app URL at vibe'nscan and get instant findings on exposed endpoints, missing security headers, and surface-level vulnerabilities — no sign-up required.
- 2Connect your GitHub for a full code audit. Our read-only audit scans your entire repository with deterministic rules and LLM analysis, producing a comprehensive report with prioritized findings.
- 3Fix critical issues before deployment. Every critical finding represents a real risk. Our reports include remediation guidance so you can fix issues fast without needing a security degree.
Methodology
vibe'nscan uses a two-layer scanning approach:
Layer 1: Deterministic Rule Engine
Fast, rules-based scanning that checks for known vulnerability patterns: exposed secrets, debug endpoints, missing authentication, hardcoded configuration, insecure dependencies, and twelve-factor violations. This layer catches the majority of findings (85%+) with zero false positives and instant results.
Layer 2: LLM-Powered Deep Audit
For comprehensive analysis, an LLM agent reviews the full codebase context — analyzing architecture, data flow patterns, security boundaries, and business logic vulnerabilities. This catches subtle issues that rules-based scanning misses, such as insecure session handling, privilege escalation paths, and data exposure through indirect references.
Data snapshot taken on July 7, 2026 from the production scan_reports table. Metrics include baseline counts from pre-launch audits plus live scan data. Severity and category breakdowns are from raw anonyomized database findings.