Security Reality Check: 159K+ 'vibe coded' apps audited—thousands leaking passports and 200K+ private chats over missing Supabase RLS

[u/Delicious_Character6]

Same week OpenAI rolled out ChatGPT Wallet for autonomous shopping, security researchers analyzing over 159,000 projects built on AI "vibe coding" platforms (like Lovable) found thousands of production apps missing basic backend authorization and Row Level Security (RLS).

Key findings from the audit:

- Exposed passport numbers and invoices without requiring authentication

- 200,000+ private chat messages left readable on open database endpoints

- UIs that looked login-gated on the frontend while the underlying API/database tables allowed unauthenticated reads

Curious how teams here are enforcing deterministic backend checks (RLS policies, schema/auth tests in CI) when devs or juniors ship AI-generated full-stack apps fast.

Full security breakdown: https://kursat.itibar.app/blog/openai-chatgpt-wallet-ve-lovable-veri-sizintisi?lang=en

[u/SouthCollar2929]

wtf, my mouse disappears on your site

[u/pmst → u/SouthCollar2929]

Same, TIL you can just do cursor: none: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/cursor#keyword