2026-10-26

Your JS bundle is public: 400+ secrets found in vibe-coded apps

Escape's research team scanned more than 5,600 public apps built on Lovable, Base44, Create.xyz, Bolt.new and similar platforms. They found over 2,000 vulnerabilities, 400+ exposed secrets and 175 cases of exposed personal data. Most of it was reachable without logging in, and Supabase service role keys were often sitting right in the frontend JavaScript.

Read Escape's methodology write-up for the details.

The check for your app: open your live site, press F12, and search the loaded JS files for service_role, sk_live and secret. The Supabase anon key is fine to ship if RLS is on; the service role key bypasses RLS and must only live on the server. If you find one, rotate it today.

Want the check done for you? Scan your app with VibeGuard.