VibeMethodology
What we cover
Security and reliability incidents involving apps built with AI coding tools (Lovable, Bolt, v0, Replit, Base44, Cursor, Claude Code, Codex and similar), and flaws in those tools themselves.
Sourcing
Every claim on an incident page comes from a linked source: the researcher's own write-up, the vendor's advisory or statement, a CVE record, or reporting from an established outlet. If we cannot source a detail, we leave it out. Where sources disagree, we say so.
Entry types
- Incident A real-world event in a production system: data exposed, abused or destroyed.
- Vulnerability A disclosed flaw or CVE in a tool or platform. Exploitation may or may not have happened.
- Research A study or scan that measures a problem across many apps or models.
When the sources leave it unclear, we use the more cautious type: Vulnerability rather than Incident if nobody has shown real-world harm.
Dates
Each entry lists four dates: when the incident happened, when it was disclosed, when we added it, and when we last checked it against its sources. If the sources do not give a date, we say "Not stated" instead of guessing. Times in UTC are shown as the source gives them.
Verification
Before an entry is published or updated, every source link is re-fetched and the key numbers and dates are checked against the source text. Anything we cannot confirm is removed or reworded. Changes that affect meaning are listed under "Corrections and updates" on the entry.
Severity
- CRITICAL Unauthenticated or cross-tenant access to sensitive data or credentials, or code execution, affecting many users.
- HIGH Serious data exposure or destructive action, but limited in scope, recovered, or requiring specific conditions.
- MEDIUM A real flaw with limited or no confirmed impact.
Ratings are our editorial judgment. Where a CVSS score exists we link to it.
Fairness
We include the vendor's response and fixes, credit fast responses, and note when a vendor disputes a finding. Incidents happen on every platform; the point is to learn the pattern and check your own app.
Independence
VibeIncidents is editorially independent. Entries end with a pointer to LockedVibe's free pack or scan, which is run by the same owner. That link never affects what we cover or how we rate it. We do not take payment to include, remove or soften an entry.
Corrections
If something here is wrong, tell us and we will fix it and note the change.