What Happens When Your Vibe-Coded App Gets Hacked: Real Attack Scenarios

Scenario 1: The Supabase Service Key in the Bundle

A founder built a SaaS app with Lovable using Supabase for auth and database. The app was deployed on Vercel, users were signing up, and everything looked professional. Then a 14-year-old found the Supabase service role key in the JavaScript bundle.

Step 1: The attacker opens the deployed site in Chrome, opens DevTools > Sources, and searches for "supabase." They find NEXT_PUBLIC_SUPABASE_SERVICE_KEY in the webpack bundle.

Step 2: The service role key bypasses Row Level Security. Using the Supabase REST API directly: curl -H "apikey: [stolen-service-key]" -H "Authorization: Bearer [stolen-service-key]" "https://abc.supabase.co/rest/v1/users?select=*"

Step 3: Full database dump. Every user's email, hashed password, profile data, and billing information. Total time: 4 minutes.

According to the IBM 2024 Cost of a Data Breach Report, the average cost of a data breach is $4.88 million. For a solo founder, the GDPR fine alone can be up to 4% of annual revenue or 20 million euros, whichever is higher.

Scenario 2: SQL Injection via the Search Bar

A developer built an e-commerce dashboard with Cursor. The search feature used a raw SQL query with string interpolation - a pattern Cursor generates by default.

// The vulnerable code Cursor generated
app.get('/api/products/search', async (req, res) => {
  const { q } = req.query;
  const results = await db.query(
    `SELECT * FROM products WHERE name LIKE '%${q}%'`
  );
  res.json(results);
});

Attack: The attacker enters this in the search bar: ' UNION SELECT email, password_hash, null, null FROM users --

The query becomes: SELECT * FROM products WHERE name LIKE '%' UNION SELECT email, password_hash, null, null FROM users --%'

Result: The product search returns every user's email and password hash instead of products. The attacker can now crack the hashes offline, or use the credentials directly if passwords were stored in plaintext (another common AI code pattern). The OWASP Foundation has ranked injection attacks as the #1 web application vulnerability for over a decade.

Scenario 3: The Unprotected Admin API

A Bolt.new app had a clean user interface with role-based access. Admins saw extra buttons, regular users saw their own data only. But the API routes behind those buttons had no authentication checks.

Attack: The attacker opens DevTools > Network tab, watches what API calls the admin buttons make. Then calls those endpoints directly:

# Found by watching network requests
curl https://app.example.com/api/admin/users        # Returns all users
curl -X DELETE https://app.example.com/api/admin/users/123  # Deletes user 123
curl https://app.example.com/api/admin/export-data   # Full data export

No token required. No auth check. The frontend hid the buttons, but the API was wide open. Total time to discover: 2 minutes with a browser's DevTools.

Scenario 4: The Hardcoded Stripe Key

An AI-generated app had the Stripe secret key (sk_live_) in the source code. The attacker used it to:

1. List all customers and their payment methods
2. Issue refunds to their own account
3. Create charges on existing payment methods
4. Access dispute and billing data

Stripe's API with a secret key gives complete control over the merchant's payment processing. According to the Verizon 2024 DBIR, financial motives drive 95% of breaches. A stolen Stripe key is the most directly monetizable credential an attacker can find.

Why These Attacks Work Every Time

How to Prevent These Scenarios

Every scenario above is preventable with automated scanning. The attacks exploit common, well-known vulnerability patterns that have well-known fixes: parameterized queries, server-side auth middleware, environment variables for secrets, and database access policies.

Tools like VibeDoctor (vibedoctor.io) automatically scan your codebase for all of these patterns - exposed secrets, SQL injection, missing auth, and insecure configurations - and flag specific file paths and line numbers. Free to sign up. Run a scan before your next deployment, not after your first breach.

FAQ