Not verified
First-quarter 2026 assessment of 200 apps
183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.
2026-04
Finding
Some storage buckets are readable by anyone with the address
These buckets are marked public, so any file inside one can be read by anyone who knows or guesses its address: {buckets}.
Last updated September 20, 2026
Before launch · Needs a developer
Why AI-built apps get this
File storage is created the moment an app needs an upload, and the bucket is public because that is the setting that makes the first upload appear on the page. Nothing later goes back to close it, and every file added after that inherits the decision.
What it affects
These buckets are marked public, so any file inside one can be read by anyone who knows or guesses its address: {buckets}.
What the evidence line looks like
the bucket listing answered the published browser key with 4 buckets, 2 of them public
Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.
The fix
Make each bucket private unless every file in it is meant for the open internet, and serve private files through short lived links instead.
Prompt for your coding agent
Set every storage bucket that holds customer files to private and serve those files through short lived signed links.
A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.
Incidents that involved this
- Observed
Moltbook records exposure
An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.
2026-01 - Not verified
Tea app, first breach
An unprotected storage instance exposed tens of thousands of user images, including identity documents.
2025-07 - Not verified
Tea app, second breach
Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.
2025-07 - Observed
Lovable-built apps, CVE-2025-48757
Broken access control reported across 170 production applications built with Lovable.
2025-05
Run this check yourself
This page is the explanation of the finding. The free tool runs the same check on your own app and returns the evidence line.
Related terms
Run the free Launch Risk Check on your app
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026