In-depth articles on every security, performance, and code quality issue VibeDoctor diagnoses - with real code examples, fixes, and explanations for founders and developers using AI coding tools.
We scanned shadcn-ui/taxonomy, the template thousands of SaaS apps started from. Its webhook mistypes renewal events, so paying customers quietly lose PRO.
We scanned vercel/nextjs-subscription-payments: 93 findings, checkout sessions created with zero rate limiting, and five advisories in the pinned Next.js.
We scanned mckaywrigley/chatbot-ui: a token in a Supabase migration, a critical form-data CVE, and await-in-map slowing every file upload.
AI code generators often create API routes without authentication. Learn how to detect and fix unprotected endpoints in your vibe-coded app.
AI tools like Bolt and Cursor generate SQL injection vulnerabilities 2.74x more often. Learn to spot and fix string interpolation in database queries.
dangerouslySetInnerHTML and innerHTML are XSS time bombs in AI-generated React code. Learn how to detect and eliminate cross-site scripting risks.
Wildcard CORS origins let any website call your API. Learn how AI tools misconfigure Access-Control headers and how to fix them.
AI code generators often use GET requests for mutations like delete and update. Learn why this creates CSRF vulnerabilities and how to fix it.
Prefixing secrets with NEXT_PUBLIC_ or VITE_ exposes them in the browser bundle. Learn how AI tools cause this critical mistake.
AI-generated cookie code often skips httpOnly, Secure, and SameSite flags. Learn what each flag does and why your session cookies need them.
Dynamic code execution via eval() is one of the most dangerous patterns in AI-generated code. Learn safer alternatives.
AI tools use Math.random() for tokens and IDs. Learn why this is predictable and how to use crypto.randomUUID() instead.
Most AI-generated API routes accept any input without validation. Learn how to add Zod or Joi schema validation to protect your endpoints.
AI tools generate file upload endpoints without type validation or size limits. Learn how attackers exploit this and how to fix it.
AI-generated APIs almost never include rate limiting. Learn how attackers abuse this and how to add rate limiting in minutes.
AI coding tools embed API keys directly in source code. Learn how to find hardcoded Stripe, OpenAI, and AWS keys before attackers do.
Recent npm supply chain attacks plant code inside Claude Code and VS Code config files. Uninstalling the package does not remove it. Sources: Microsoft, Snyk, StepSecurity, Tenable.
A single broken access-control flaw exposed thousands of Lovable projects: source code, Supabase credentials, and user data, reachable in five API calls. What it means for anyone shipping AI-built apps. Sources: TNW, Metamindz, CSA.
Removing a secret from code doesn't remove it from Git history. Learn how Gitleaks scans your full commit history for API keys and credentials.
Vibe coding tools often commit Supabase anon keys and Firebase configs to Git. Learn which credentials are safe to expose and which are not.
A pre-commit hook with Gitleaks stops secrets from ever reaching your repository. Here is how to set it up in 5 minutes.
AI tools install 60+ packages for a simple app. Learn how dependency bloat increases attack surface, slows your app, and how to trim it.
Using * or latest in package.json is a supply chain attack waiting to happen. Learn how to pin versions and protect your build.
Your dependencies may have known CVEs. Learn how Trivy scans npm packages against the National Vulnerability Database.
The framework behind the npm supply chain attacks of mid-2026 is now public. Copycats are already shipping. What indie builders shipping AI-generated code should actually do. Sources: Tenable, StepSecurity, GitGuardian, Krebs on Security.
AI tools mix .then()/.catch() with async/await in the same file. Learn why this causes bugs and how to standardize your async code.
AI code generators build massive functions with deep nesting and too many parameters. Learn refactoring patterns to break them down.
AI generates 500-line files that handle routing, data, UI, and business logic. Learn how to detect and decompose monolithic files.
Cursor, Bolt, and Lovable generate .then() without .catch() and try blocks without meaningful catches. Learn how to add real error handling.
AI tools leave TODO comments and empty functions in production code. Learn how to find and complete every unfinished implementation.
AI code generators invent package names that don't exist on npm. Learn how hallucinated imports break builds and how to detect them.
ESLint catches style issues. SonarQube catches bugs, security hotspots, and technical debt. Learn what enterprise-grade static analysis reveals.
Source code analysis explained: the four layers (SAST, secret detection, dependency CVEs, structure), real findings from each, and how to analyze your source code online free in about a minute.
AI tools put await inside .map() creating sequential execution instead of parallel. Learn the fix with Promise.all().
AI generates readFileSync and writeFileSync in async contexts. Learn why this freezes your server and how to switch to async I/O.
AI-generated code puts database queries inside loops, creating N+1 problems that cause 10-100x slower page loads. Learn the fix.
Without Error Boundaries, a single component error crashes your entire React app. Learn how to add resilience to AI-generated UIs.
AI tools set up intervals and event listeners in useEffect but forget cleanup functions. Learn how to prevent memory leaks in React.
AI code generators skip alt text on images and aria-label on buttons. Learn WCAG basics and how to make your vibe-coded app accessible.
AI tools often set strict: false in tsconfig.json. Learn what strict mode catches and why you should always enable it.
AI-generated code hardcodes http://localhost:3000 instead of using environment variables. Learn how to detect and fix this before deploying.
Using FROM node:latest in your Dockerfile means your builds are not reproducible. Learn how to pin Docker image versions properly.
AI-generated apps ship without a /health endpoint. Without one, your monitoring, load balancer, and container orchestrator are flying blind.
Your docker-compose.yml exposes database ports, hardcodes passwords, and runs containers as root. Here is how to secure it for production.
Step-by-step guide to deploying AI-generated apps safely. Covers environment variables, secrets, SSL, security headers, monitoring, and the checks to run before going live.
Most vibe-coded apps have zero tests. When they do, they're empty shell tests. Learn how to evaluate and build real test coverage.
AI-generated tests mock every dependency and only test happy paths. Learn how to write tests that actually catch bugs.
Your live website is throwing JavaScript errors you might not see. Learn how to detect console.error messages and runtime exceptions.
Your HTTPS site loads images or scripts over HTTP? Browsers block mixed content. Learn how to find and fix mixed content issues.
Broken links hurt your search rankings and frustrate users. Learn how to detect 404s, redirect chains, and dead external links automatically.
AI-generated apps ship 5MB+ pages with unoptimized images and 40+ network requests. Learn how to audit and reduce your page weight.
Built something on Bolt.new and about to share it? Here are 7 security and quality checks to run before your app goes live.
Lovable generates beautiful apps fast, but the generated code has security gaps. Learn what Lovable skips and how to fix it before launch.
v0 generates stunning React components, but ships XSS vectors, missing validation, and accessibility gaps. Here is what to check.
Replit makes deployment one click away, but deployed Repls often ship with exposed secrets, no auth, and zero rate limiting.
Cursor is the fastest AI coding tool, but speed creates patterns. Here are the 5 security issues that show up most in Cursor-generated codebases.
Bolt and Lovable generate apps fast. They do not generate them safe. VibeDoctor finds the security, quality, and performance issues these platforms consistently leave behind.
Supabase RLS is the #1 thing vibe coders skip. Without it, any authenticated user can read and modify every row in your database.
AI tools generate JWT code with weak secrets, missing algorithm checks, and no expiry. Learn the attacks and how to implement JWT securely.
AI gets OAuth wrong constantly. Missing state parameters, no PKCE, and open redirect URIs are the top 3 mistakes in vibe-coded OAuth flows.
Comparing three popular auth providers for AI-coded apps. Which one is most secure by default, and where does AI-generated code break each one?
NEXT_PUBLIC_ confusion is universal. Learn which Vercel env vars are safe for the browser and which ones expose your secrets to the world.
AI-generated GitHub Actions workflows accidentally print secrets to logs via echo, debug mode, and artifact uploads. Here is how to find and fix it.
A walkthrough of real attack scenarios against AI-generated apps: from finding exposed keys to full database access in under 10 minutes.
Prisma is the ORM of choice for Bolt, Lovable, and Cursor. But AI-generated Prisma code uses $queryRaw unsafely and exposes schema details.
AI tools set up WebSocket servers without authentication or origin checks. Learn how to secure real-time connections in your app.
AI-generated code is full of console.log statements that leak user data, tokens, and database queries in production. Here is how to find and remove them.
AI-generated API routes trust all input by default. Learn why Zod schema validation is essential and how to retrofit it into existing endpoints.
Before your demo day or investor pitch, make sure your AI-built app does not have embarrassing security holes that a technical due diligence will find.
The OWASP Top 10 explained for builders who use AI coding tools. No jargon, real examples from Bolt, Lovable, and Cursor-generated code.
A data breach costs enterprises $4.88M on average. For solo founders, the math is different but the damage can still end your company.
From XSS to RLS, CSRF to CORS - a plain English glossary of 40 security terms every vibe coder needs to understand.
Product Hunt launches attract thousands of users and hackers. Run these 10 security checks before your vibe-coded app goes live.
Enterprise customers ask for SOC 2. AI-generated code fails most SOC 2 controls by default. Here is what you need to fix to pass an audit.
A startup from Vienna is building tools for the security and quality gap that AI coding platforms created but were never equipped to fix.
VibeDoctor scans apps built with Bolt, Lovable, Cursor, and Replit. The data from early scans reveals how unsafe most AI-built apps are before launch.
The story behind VibeDoctor: built by a solo founder who got frustrated watching vibe-coded apps serve real users with no security scanning, no quality gate, and no production readiness check.
A step-by-step guide to reviewing and validating code written by Cursor, Bolt, Lovable, Claude Code, or ChatGPT before it goes to production.
The security checklist built for vibe coders. Covers everything Bolt, Lovable, and Cursor miss by default - secrets, unprotected APIs, CVEs, and missing headers. Automated + manual.
AI tools ship your app but don't maintain it. This is the monthly security update checklist for founders using Bolt, Lovable, Cursor, or Replit - CVEs, headers, certs, and secrets.
Practical rules for shipping AI-generated code safely. From scanning after every session to checking for hallucinated imports - how to vibe code without the regret.
10 quick questions to determine if your vibe-coded app is ready for real users. Answer honestly, fix the gaps, and ship with confidence.
Data from scanning thousands of AI-generated codebases reveals the most common security, quality, and performance issues. The patterns every vibe coder should know.
Veracode finds 45% of AI code ships an OWASP Top 10 flaw, CVEs traced to AI code jumped from 6 to 35 a month, and 1 in 5 imports are hallucinated. The data, and what to check before you ship. Sources: CSA, Veracode, Apiiro, Snyk.
We compared code generated by Claude, GPT-4, and Gemini across 10 security checks. Here is which model produces the fewest vulnerabilities.
Step-by-step guide to wiring Cursor, VS Code Copilot, Claude Code, or Windsurf to VibeDoctor MCP for real-time code validation as your AI agent writes code.
Model Context Protocol lets AI tools access your files, database, and APIs. Here are the security risks most developers overlook.
A data-driven look at how AI-generated code quality has evolved. What improved, what got worse, and what every builder should watch.
SonarQube, Snyk, and CodeRabbit were designed for professional engineering teams. VibeDoctor fills the gap they left open for AI-generated apps.
Developers waste thousands of AI tokens per session because they lack codebase visibility. Structural code intelligence cuts token usage and improves AI output quality.
Five free AI code review tools compared: VibeDoctor, npm audit, ESLint, GitHub code scanning, Snyk. What each catches, what each misses, and which to run first.
Attackers are registering npm packages that AI tools hallucinate. Learn how slopsquatting works, why it targets vibe-coded apps, and how to detect hallucinated imports.
Claude Code, Devin, and Cursor Agent can build entire applications autonomously. But AI agents introduce security and quality issues at scale. Here is what to check.
Prompt injection tops the OWASP 2026 list and the Bitwarden CLI worm hunted Claude, Cursor and Codex credentials. Why the code your agent commits is now your attack surface. Sources: Help Net Security, Microsoft, Palo Alto, Endor Labs.
Server Actions look safe because they run on the server. But AI-generated Server Actions skip auth, leak data, and accept unvalidated input.
AI tools generate Supabase Edge Functions with exposed service role keys, no input validation, and missing CORS config. Here is how to fix them.
AI-generated Stripe code skips webhook signature verification, trusts client-side prices, and exposes secret keys. Here are the critical fixes.
Vibe X-Ray is VibeDoctor's four-level visual code explorer. See modules, files, symbols, and dependencies in your AI-generated codebase - understand what was built before you ship.
Vibe Story auto-plays a plain-English walkthrough of your AI-built app the moment a scan finishes - no clicks, no code reading. It narrates your main user journeys straight from your code's own comments.
AI writes code fast but loses the thread when you debug. See how Vibe X-Ray maps your codebase so you - and your AI agent - get the exact context to find and fix bugs without dumping your whole repo.
VibeDoctor's Vibe Check runs 149+ automated checks across 21 diagnostic areas - security, performance, code quality, dependencies, and AI-specific patterns. Get a full diagnosis in under 5 minutes.
VibeDoctor's Vibe Monitoring watches your app's uptime, performance scores, SSL certificates, and security headers. Get alerted before your users notice something is wrong.
AI tools ship your app but don't keep it running. SSL expiry, missing headers, degrading performance, and unhandled errors - the production failures unique to vibe-coded apps.
AI tools generate hundreds of files in a single session. Without structural visibility, you can't maintain, debug, or extend the code. Visual code intelligence changes that.
The CRA makes vulnerability handling a legal duty for software sold in the EU: SBOMs, security updates, and 24-hour exploit reporting. What founders must do before the 2026 and 2027 deadlines.
NIS2 makes vulnerability handling and disclosure a board-level legal duty across the EU, with fines up to 10 million euros. Here is what it actually requires and how small teams can comply.
European regulators have fined companies tens of millions for breaches caused by ordinary web vulnerabilities. Why Article 32 turns scanning and patching into a legal obligation, not a best practice.
When a scanner analyzes your repository, your source code and secrets travel to its servers. Why EU data residency matters after Schrems II, and what to ask any security vendor.
CVE scanning, secret detection, SAST, security headers, and disclosure policy: the five layers enterprises run, and how a small European team can run all of them for less than a lunch.
Don't read about issues - diagnose them.
SCAN MY APP FREE →