New accounts are active before the address is confirmed

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

The public auth settings report that new sign ups are confirmed automatically, so an account can be created with an address the person does not own.

the public auth settings report mailer_autoconfirm: true

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Turn email confirmation on so an address has to be proved before the account works.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Not verified

  First-quarter 2026 assessment of 200 apps

  183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

  2026-04

  Read the incident
• Not verified

  Tenzai study of AI-built apps

  69 vulnerabilities across 15 apps built by five AI coding tools.

  2026-02

  Read the incident
• Not verified

  Tea app, second breach

  Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.

  2025-07

  Read the incident
• Not verified

  Base44 authentication flaw

  A platform-wide authentication flaw allowed access to private enterprise data.

  2025-01

  Read the incident

• open signup
• observed
• evidence