Vibe Coding Security: What 1,969 Lovable Apps Reveal

A community researcher scanned nearly 2,000 public Lovable apps this week and found real secrets sitting in the open — not the anon keys that are supposed to be public, but committed .env files and hardcoded credentials. The same week, Lovable shipped a new security-transparency feature, and Vercel's own engineering team published a blunt warning about where AI is pushing the balance of power in offensive security. Here's what actually changed and what it means if you shipped an app with an AI builder.

TL;DR

• A scan of 1,969 public Lovable repos found 23.2% had a committed .env file and 42.2% tripped a hardcoded-credential rule — real keys, passwords, JWTs, or connection strings written straight into code. (source)
• Lovable now auto-generates a Trust Center page for every published app, at /.well-known/trust.html and /.well-known/trust.json, listing security facts about the live version. (source)
• Vercel published a piece arguing that near-frontier open-weight AI models can already do real offensive security work, and the defender's edge over AI-assisted attackers will not last. (source)
• Vercel also hardened its own platform this week: Enterprise Managed Users (SSO-only sign-in) went GA, Connect now logs every token's full lifecycle, and OIDC tokens support custom audiences. (source)

The real leak: env files and hardcoded keys, not anon keys

A Reddit user built a list of 5,286 public repos generated by Lovable (findable through the lovable-tagger plugin Lovable writes into every project), scanned a shuffled sample of 1,969 with a rules-based check, and posted raw per-app results. The findings: 23.2% had a .env file committed straight into the repo, and 42.2% tripped a rule for hardcoded credentials — a key, password, JWT, or connection string typed directly into source code. (source)

This is worth being precise about. A Supabase anon key or a Firebase web config showing up in your client bundle is not a leak — those are public by design, meant to be read by the browser. What this scan found is different: .env files (which typically hold service-role keys, database URLs, or third-party API secrets) and hardcoded credentials sitting in version control where anyone can clone the repo and read them. That is the actual exposure. If your app was scaffolded by an AI builder and pushed to a public GitHub repo, check it now.

Lovable's answer: a security page, not a fix

On the same day, Lovable's changelog added a Trust Center for every publicly published app: a page at /.well-known/trust.html, with a machine-readable JSON twin, listing the security facts Lovable observed about the live version of your app. The stated use case is answering a customer's security question with a link instead of a questionnaire. Lovable is explicit that it's informational, not a certification. (source)

That distinction matters given the scan above. A Trust Center can tell a visitor what Lovable observed. It does not stop you from committing a .env file, and it does not audit your database rules. Treat it as a status page, not a guarantee.

The threat side is moving too

Vercel's engineering team published a piece this week making a specific claim: near-frontier open-weight AI models are already capable enough to do real offensive security work, and the current gap — where defenders can use stronger closed models than the open-weight models available to attackers — will close. The framing is unusually direct for a platform vendor: good news and bad news, and most of the community hasn't priced in the bad news yet. (source)

Read alongside the Lovable scan, the picture is straightforward: mistakes that used to be low-risk because they were hard to find automatically (a stray .env, a hardcoded key in a commit history) are getting easier to find at scale, by AI as much as by humans.

Platforms are hardening the plumbing

While app-layer mistakes persist, the infrastructure underneath is getting stricter about identity and tokens. Vercel's Enterprise Managed Users went generally available this week, forcing SSO-only sign-in for accounts on verified company domains — email OTP, GitHub, and Google logins stop working for those accounts. (source) Vercel Connect added an observability tab showing every token's full lifecycle: who created it, what used it, and whether it's still active. (source) And Vercel's OIDC issuer now supports custom token audiences, so a compromised third-party provider can't replay a token against a different service. (source)

None of this reaches into your repo to remove a committed secret. It hardens the pipes; it doesn't check what you poured into them.

FAQ

How many Lovable apps leak secrets?

In a scan of 1,969 public Lovable-generated repos, 23.2% had a .env file committed to the repo and 42.2% tripped a rule for hardcoded credentials — keys, passwords, JWTs, or connection strings written directly into code. This was a rules-based scan of a shuffled sample, not a claim about every Lovable app. (source)

What is the Lovable Trust Center security page?

It's an automatically generated status page, published at /.well-known/trust.html (and a JSON version at /.well-known/trust.json) for every publicly published Lovable app, listing security facts Lovable observed about the live version. Lovable describes it as informational, not a certification — it does not audit your database rules or check for committed secrets. (source)

Are AI models getting better at hacking?

According to Vercel's engineering team, yes — near-frontier open-weight AI models can already perform meaningful offensive security work, and the current gap between what defenders and attackers can access is expected to close. Vercel frames this as underappreciated by the wider community right now. (source)

The bottom line

The leak this week isn't a hyped-up anon key story — it's committed .env files and hardcoded credentials in nearly a quarter to nearly half of scanned Lovable repos, found by a straightforward rules-based scan anyone could run. Lovable's new Trust Center is a useful transparency signal but doesn't fix that class of mistake, and it isn't a certification. Meanwhile the platforms underneath — Vercel in particular — are tightening identity and token controls while warning that AI is making offensive security more accessible. If you shipped with an AI builder, the actionable item isn't philosophical: check your repo for a committed .env, rotate anything that's been exposed, and don't mistake a public anon key for the actual problem.