What Happens When Your Vibe-Coded App Gets Hacked: Real Attack Scenarios

Scenario 1: The Supabase Service Key in the Bundle

A founder built a SaaS app with Lovable using Supabase for auth and database. The app was deployed on Vercel, users were signing up, and everything looked professional. Then someone found the Supabase service role key in the JavaScript bundle.

Step 1: The attacker opens the deployed site in Chrome, opens DevTools > Sources, and searches for "supabase." The build inlined the value of VITE_SUPABASE_SERVICE_KEY into the JavaScript bundle (this app is one of the React + Vite Lovable apps, and Vite exposes VITE_ variables in client-side code), so next to the project URL they find a key whose decoded payload says "role": "service_role".

Step 2: The service role key bypasses Row Level Security. Using the Supabase REST API directly: curl -H "apikey: [stolen-service-key]" -H "Authorization: Bearer [stolen-service-key]" "https://abc.supabase.co/rest/v1/users?select=*"

Step 3: Full database dump of every table the API exposes: user emails, profile data, and billing information. (Supabase keeps password hashes in the auth schema, which the auto-generated API does not expose.) Total time: 4 minutes.

According to the IBM 2024 Cost of a Data Breach Report, the global average cost of a data breach was $4.88 million. For a solo founder, the GDPR fine alone can be up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher (GDPR Article 83(5)).

Scenario 2: SQL Injection via the Search Bar

A developer built an e-commerce dashboard with Cursor. The search feature used a raw SQL query with string interpolation - a pattern AI assistants often generate.

// The vulnerable code Cursor generated
app.get('/api/products/search', async (req, res) => {
  const { q } = req.query;
  const results = await db.query(
    `SELECT * FROM products WHERE name LIKE '%${q}%'`
  );
  res.json(results);
});

Attack: The attacker enters this in the search bar: ' UNION SELECT email, password_hash, null, null FROM users --

The query becomes: SELECT * FROM products WHERE name LIKE '%' UNION SELECT email, password_hash, null, null FROM users --%'

Result: The product search returns every user's email and password hash instead of products. The attacker can now crack the hashes offline, or use the credentials directly if passwords were stored in plaintext (another common AI code pattern). Injection is still in the OWASP Top 10 (third in 2021, A05 in 2025).

Scenario 3: The Unprotected Admin API

A Bolt.new app had a clean user interface with role-based access. Admins saw extra buttons, regular users saw their own data only. But the API routes behind those buttons had no authentication checks.

Attack: The attacker opens DevTools > Network tab, watches what API calls the admin buttons make. Then calls those endpoints directly:

# Found by watching network requests
curl https://app.example.com/api/admin/users        # Returns all users
curl -X DELETE https://app.example.com/api/admin/users/123  # Deletes user 123
curl https://app.example.com/api/admin/export-data   # Full data export

No token required. No auth check. The frontend hid the buttons, but the API was wide open. Total time to discover: 2 minutes with a browser's DevTools.

Scenario 4: The Hardcoded Stripe Key

An AI-generated app had the Stripe secret key (sk_live_) in the source code. The attacker used it to:

1. List all customers and their payment methods
2. Refund past payments, draining the merchant's balance
3. Create charges on existing payment methods
4. Access dispute and billing data

Stripe's API with a secret key gives complete control over the merchant's payment processing. According to the Verizon 2024 DBIR, financial gain remains the clear leading motive behind breaches. A stolen Stripe key is one of the most directly monetizable credentials an attacker can find.

Why These Attacks Work Every Time

How to Prevent These Scenarios

Every scenario above is preventable, and most are caught by automated scanning. The attacks exploit common, well-known vulnerability patterns that have well-known fixes: parameterized queries, server-side auth middleware, environment variables for secrets, and database access policies.

Tools like VibeDoctor's Vibe Check automatically scan your codebase for exposed secrets, SQL injection, API routes without auth middleware, and insecure configurations, and flag specific file paths and line numbers. It does not read your Supabase RLS policies, so check those in the Supabase dashboard. Free to sign up. Run a scan before your next deployment, not after your first breach.

FAQ