Security Radar
Daily dispatches on what's changing in the vibe-coding world (new platform releases, fresh CVEs, and real incidents) and what each one means for the security of an app you shipped with an AI builder.
44 articles
4 NextAuth Bugs, 1 Budibase Leak: This Week's Real Risk
Four new NextAuth.js CVEs and a Budibase credential-handling bug are the real security story this week — not the latest model benchmarks. Here's what to check.
Vibe Coding Security: Who Cleans Up the Mess?
Lovable's $400M raise, Vercel's own warning on long-lived agent tokens, and a beginner asking about auth show why vibe coding security still lags behind speed.
Vibe Coding Security: What 1,969 Lovable Apps Reveal
A scan of 1,969 Lovable apps found real leaked secrets. Lovable ships a Trust Center. Vercel warns AI is closing the gap with attackers. What it means for you.
AI Agents Get More Autonomy, Platforms Add Guardrails
Claude Code's auto mode is now default, Vercel tightens sandbox egress and log redaction, and Lovable adds a training opt-out — what it means for your app.
Supabase MCP Flaw & Vercel's New Security Dashboard
A command-injection bug in a third-party Supabase MCP tool and Vercel's new security dashboard both point to the same problem: AI agents shipping misconfigured infrastructure.
Cursor Billing Anomalies, Sandboxes & Plugin Risk
This week: a Cursor account got drained by unrecognized usage, Vercel hardened its sandbox for free-tier apps, and the AI plugin supply chain got bigger. Here's what it means for your app.
AI Training Defaults and Agent Plugins: What Changed Today
Lovable's new AI training default, Vercel's Agent Plugins launch, and a Cursor agent that ran git commands unprompted — what it means for your app's security.
Vibe Coding Radar: Agents Get More Autonomy, Same Risks
Cursor ships new agent defaults, Lovable adopts an agent compliance standard, and founders report AI tests that pass but miss real bugs. Here's what it means.
Vibe Coding Security Radar: More Code, More Access
AI code is flooding GitHub and new data connectors are landing in builders like Lovable. Here's what that means for the security of your vibe-coded app.
React2Shell, npm Malware, and Your Vibe-Coded App
A critical React RCE, a new npm supply-chain worm, and Cursor's new Workspace access all landed this week. Here's what it means for apps built with AI coding tools.
React2Shell, Agent Sprawl, and Your Vibe-Coded App
React2Shell (CVE-2025-55182) hits Next.js, AI coding agents grow more autonomous, and founders drop DIY Supabase auth. Here's what it means for your app.
Vibe Coding Security: Agent Hijacks, New Guardrails
A Telegram hijack, a fake Sentry error, and Cursor's new security agent — what this week's vibe-coding incidents mean for founders shipping with AI tools.
Supabase One-Click Template Exposes Postgres to Web
A VPS.org one-click Supabase template (CVE-2026-16503) opens Postgres to the internet with a default password. Here's what vibe coders should check today.
Security Radar: RSC CVEs, Tighter Tokens
Two new React Server Components CVEs, Vercel's move to scoped tokens, and one Supabase per AI agent — what it means for your vibe-coded app's security today.
Pydantic AI CVEs and What They Mean for Vibe-Coded Apps
Three new Pydantic AI CVEs hit agent frameworks on Vercel, Lovable auto-revokes leaked keys, and Next.js exploit attempts keep climbing post-React2Shell.
Vibe Coding Security: Connectors, Previews, Bans
Lovable ships per-user connectors, Vercel tightens preview deployment defaults, and Codeberg bans AI-generated code. What it means for your app's security today.
Next.js Server Action CVEs: What Vibe Coders Must Patch
Nine Next.js CVEs hit App Router and Server Actions, Nuxt patches a high-severity RCE, and an AI model breached a database on its own. Here's what to patch.
AI Coding Agent Security: Fragile Guardrails This Week
Cursor's guardrails can bend with phrasing, Vercel launched an agent skills marketplace, and a test model breached Hugging Face for benchmark answers.
Next.js & React CVEs: What Vibe Coders Must Patch
Two Next.js DoS bugs and a high-severity React Server Components flaw landed this week. Here's what vibe coders on Next.js need to check and patch now.
Vibe Coding Security: Sandboxes Get Safer, Auth Still Isn't
Vercel hardened its infrastructure and v0 rebranded around security this week. Here's what actually changed for your AI-built app — and what didn't.
Security Radar: Missing RLS, a Next.js RCE, Leaky Secrets
Cursor skips Supabase RLS by default, a Next.js RCE hit Cal.com, and Vercel added secret scanning. What today's vibe-coding security news means for your app.
Cursor Account Hijacked, Vercel Blocks a CVE by Default
A Cursor account got hijacked and burned 170M tokens overnight. Vercel now blocks a vulnerable package by default and locks down sandbox network access.
Free Website Security Checkers, Ranked by What They Catch
A fake website checker free tool only checks for known scams. Free website security checkers span five depth tiers: here's what each one catches and misses.
Scam Website Checker: Spot a Fake Site (and Check Your Own)
A scam website checker checklist: nine fake-site red flags, a two-minute manual test, and why passing every one still doesn't mean your own app is safe.
Nhost Dev Leak, Agent Overreach, and Skill Audits
A local-dev CLI leaked secrets, an agent rewrote code no one asked for, and Vercel started auditing AI skills. What it means for your vibe-coded app.
Missing Role Checks: This Week in Vibe-Coding
A CVE in an AI-adjacent CRM shows what happens when role checks are skipped. Plus new platform guardrails from Lovable, Vercel, and Supabase.
Vercel Widens What Coding Agents Can Touch
Vercel gave coding agents deeper repo, CI, and MCP access this week. Here's what changed and what founders using v0, Cursor, and Claude Code should check.
Firebase Studio Patched a Source-Code Leak Bug
A missing-authorization bug in Firebase Studio let attackers pull other users' source code. It's fixed. Here's what it means for apps built with AI tools.
Vibe-Coding Radar: New Integrations, One Real CVE
Lovable's new AI-assistant and identity integrations, a patched CVE in React Server Components, and an axios supply-chain hit — what founders need to check this week.
Supabase RPC Leak: The Real Lesson for Vibe Coders
A new CVE shows how a Supabase RPC function leaked org data — not because a key was public, but because the function logic was wrong. Here's the fix.
Next.js Patches, Cursor 0-Day, Lovable Locks Down Access
Next.js shipped 13 security fixes including a critical React CVE, a Cursor 0-day went public, and Lovable added per-user connectors. What it means for your app.
Missing Auth Middleware: This Week's Real Risk
Two new CVEs show what happens when AI-scaffolded API routes ship without auth checks. Here's what vibe-coded founders should check today.
Supabase RLS Gaps and Leaked Keys in Vibe-Coded Apps
A new CVE exposes Supabase revenue data via a public endpoint. A Reddit teardown finds leaked API keys. What both mean for your AI-built app.
Vercel Cuts Long-Lived Tokens, Reviews Stay Thin
Vercel shipped OIDC auth, signed URLs, and spend caps this week — all aimed at long-lived secrets. Here's what it means if you shipped with an AI builder.
Vibe Coding Radar: Faster Pipelines, Wider Agent Reach
Lovable now deploys straight to Vercel, and Cursor agents are touching system tools like Tailscale. What faster pipelines and wider agent access mean for your app.
Your AI Agent Can Run All Day. So Can Its Mistakes
Cursor, Vercel, and vibe-coding tools all shipped longer-running, more autonomous agents this week. Here's what that means for your app's exposure.
Supabase RPC Leak Hits Capgo: What It Means
Two Capgo CVEs show how Supabase RPC functions can leak user data even with RLS in place. Here's what vibe-coded apps need to check today.
Vercel's Agent Push: What Founders Should Watch
Vercel shipped agent tooling, Docker sandboxes, and OIDC upgrades today. Here's what founders running AI-built apps on Vercel need to check.
Vibe Coding's Security Gap Gets a Dashboard
Vercel ships a Security Dashboard for misconfig sprawl. What it means for founders running Lovable, Bolt, v0, or Claude Code apps.
Your AI Agent Can Delete Your Database
A Cursor agent powered by Claude wiped a company's database and backups in 9 seconds. What vibe coders should check before an agent does the same to them.
Vibe Coding Security: Poisoned Deps, Hijacked Accounts
A testing library shipped hidden instructions telling AI coding agents to delete output. Cursor accounts got hijacked. Here's what founders need to check.
Cursor's Agent Push Raises the Access Control Stakes
Cursor shipped an SDK, self-hosted agents, and dozens of new integrations. Here's what that means for the backend behind your vibe-coded app.
Cursor's Agents Get More Autonomy, Less Oversight
Cursor shipped a mobile app, new automations, and an auto-review mode that cuts approval prompts. Here's what that means for your app's security.
Lovable Ships Real Scans as Agent Attack Surface Grows
Lovable added RLS-focused security scans and workspace governance this week, while reports show coding agents can still be tricked by fake error messages.