VibeRedAccess scan: 380,000 vibe-coded assets, about 5,000 corporate apps, roughly 2,000 exposing private data
Summary
Security firm RedAccess reviewed about 380,000 publicly reachable assets built with Lovable, Replit and Base44 or deployed on Netlify. About 5,000 were built for corporate use. Around 40% of those exposed sensitive data, and close to 2,000 revealed private records to anyone with the URL. WIRED verified that several of the exposed apps were still online, and VentureBeat reports that Axios verified others. Replit said RedAccess gave it only 24 hours before going to the press; Lovable and Base44 said they were not given the URLs needed to check the findings.
Severity
Timeline
WIRED reports the findings.
VentureBeat follows; it reports that Axios also verified several exposed apps.
TechTarget publishes its analysis.
How it happened
Per WIRED, many apps had no login at all, and others only asked visitors to sign in with any email address. Several platforms make it easy to publish to a public URL, and internal tools built by employees often never reach a security team's inventory. In some cases the researchers say they could have gained admin rights. Note: sources describe the 5,000 differently. RedAccess's report page calls them assets built for corporate purposes, WIRED says they had virtually no security, and VentureBeat says they contained sensitive corporate information. We use RedAccess's own wording. Base44 told WIRED that a publicly accessible app 'reflects a user configuration choice, not a platform vulnerability'.
How to check your app
- Open your app's URL in a private window. If you can see real data without logging in, so can everyone else.
- If login is 'any email', treat that as no login. Restrict sign-up to invited users or your company domain.
- List every app your team has published on a vibe-coding platform and who can reach each one.
Sources
- VentureBeat: 5,000 vibe-coded apps just proved shadow AI is the new S3 bucket crisis
- WIRED: Thousands of vibe-coded apps expose corporate and personal data
- TechTarget: Research shows the vibe coding security crisis
- RedAccess report page
Corrections and updates
Corrected the timeline: TechTarget's analysis was published Jun 2, 2026, not in May.
Attributed the Axios verification to VentureBeat's report, rewrote the note on the 5,000 figure to show how each source describes it, and added the platforms' responses (Replit, Lovable, Base44).