Research
Original studies and research roundups on vibe-coded apps and AI coding tools. Individual research findings from other teams are also logged as entries of type Research in the incident log.
Security headers on 86 public vibe-coded apps: nearly identical within each platform
We analyzed the security headers on 86 of the 95 public apps we viewed on Oct 15, 2026, built with Lovable, Bolt, Replit and v0. All 86 send the HSTS header. Almost none send a CSP, clickjacking protection or Permissions-Policy, and only 26 of 86 send Referrer-Policy and 27 of 86 send X-Content-Type-Options. Results are close to identical within each platform. That suggests hosting defaults. We have not confirmed that with the platforms.
Chart and embed code (CC BY 4.0, keep the credit line)
Exposed keys in AI-built apps: the research
Sourced figures on exposed API keys and secrets in vibe-coded and AI-assisted apps (Wiz, Escape, GitGuardian), how keys leak, and how to check your own app and repo.