Not verified
First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
2026-04
Mixed · 2026-02
5,600 vibe-coded apps scanned
More than 2,000 vulnerabilities and more than 400 exposed secrets found across vibe-coded apps.
Last updated 2026-02
Observed
What the sources report
The sources report more than 2,000 vulnerabilities across 5,600 scanned apps.
They also report more than 400 exposed secrets.
Root cause class
Study
Covered by
What ShipReady can say
Server keys left in client JavaScript are exactly what the free check reads. That is finding O4, with the evidence line and the date attached.
Sources
Related incidents
- Declared
CVE growth in AI-generated code
CVE entries attributed to AI-generated code rose from 6 in January 2026 to more than 35 in March 2026.
2026-03 - Not verified
Tenzai study of AI-built apps
69 vulnerabilities across 15 apps built by five AI coding tools.
2026-02
Check your app
Run all sixteen groups on your published address and see the evidence behind every result.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026