Vibe coding, building software by describing it to an AI instead of writing the code, is no longer a developer hobby. In a US survey of 600 non-developers published in August 2026, 36.4% said they use AI coding tools at least weekly, and only 31.5% have their code checked by a professional developer. That means someone in your business, maybe you, has probably built a form, a dashboard or a small app with Lovable, Bolt, Replit, v0 or ChatGPT, and it may already hold customer names and phone numbers.
The tools are great at making things that work. They're not good at making things private by default. Below is what changed in 2026, why AI-built apps leak, and five checks you can run on any app your team built in about 30 minutes, without reading a line of code.
US non-developers who use AI coding tools at least weekly (20i survey, August 2026).
Supabase-backed AI-built apps where anyone could read tables logged out (Reeve, Aug 2026).
AI-built apps leaking sensitive data in one scan of 380,000 assets (RedAccess, May 2026).
Non-developer builders who get their AI-written code checked by a professional.
Sources: 20i: Vibe coding survey · VibeEval: August 2026 digest of Reeve's scan · VentureBeat: 5,000 vibe-coded apps
How mainstream is vibe coding in 2026?
Mainstream enough that business newsrooms now cover it every week. Andrej Karpathy coined the term in February 2025. By March 30, 2026, Business Insider had launched Vibe Mode, a weekly newsletter tracking vibe coding and what it means for work and startups.
The people building are mostly not programmers. In 20i's survey of 600 US non-developers, 51.1% said they had very limited or no coding knowledge before using AI tools, and only 12.5% regularly wrote code before. What they build is the kind of thing a small business runs on: data analysis (48.5%), workflow automation (37.0%), single web pages (17.2%), whole websites (16.3%) and API connections between tools (14.0%).
One number from the same survey should worry every owner: 20.5% of these users said AI-written code had contributed to a security breach. It is a self-reported figure from a hosting company's survey, so read it as a warning sign rather than a measured rate. It still lines up with what security researchers found when they scanned live apps.
Sources: Talking Biz News: Business Insider launching 'Vibe Mode' · 20i: Vibe coding survey, August 2026
Why do vibe-coded apps leak customer data?
They leak because the AI builds what you asked to see, and nobody asked "who else can see this?" A vibe-coded app usually has a nice screen in front and a database behind it, often Supabase. The screen asks for a login. The database, unless someone set rules on it, may answer anyone who knows where to ask.
Three patterns showed up again and again in 2026:
- Open database tables. Supabase protects data with rules called Row Level Security (RLS): each table says who may read which rows. When RLS is off or too loose, anyone with the app's public address can read the table. In Reeve's August 2026 scan of 30,998 live vibe-coded apps, 2,096 of the 3,680 reachable Supabase-backed apps (57%) allowed reads without logging in.
- Secret keys in the page. Some apps put a powerful database key inside the code that every visitor's browser downloads. Anyone who opens the browser's developer tools can copy it.
- Platform settings nobody checked. In April 2026, The Next Web reported that a flaw on Lovable let a logged-in free user reach other users' public projects, including source code and database credentials, for projects created before November 2025. The flaw had been open for 48 days when it was reported. Lovable first said it "did not suffer a data breach" and later apologised in part.
None of this needs a clever attacker. We'd call it leaving the shop door open. Scanners did it passively, seeing only what any visitor could see.
Sources: VibeEval: Reeve scan summary · The Next Web: Lovable security crisis
Which apps actually need checking?
Not all of them. A to-do list only you use isn't a risk. Sort every app by the most sensitive thing it touches:
| Tier | What the app touches | Example | What to do |
|---|---|---|---|
| 1. Play | No real data | A landing page mock-up, a calculator | Nothing. Enjoy it |
| 2. Internal | Your business data, staff only | A sales dashboard, a stock tracker | Run checks 1 to 3 below |
| 3. Customers | Customer names, phones, emails, orders | A booking form, a lead tracker, a client portal | Run all 5 checks, then get a review |
| 4. Money or sensitive data | Payments, health, children, ID documents | A fees portal, a clinic intake form | Do not launch without a developer's review |
In India, tier 3 and 4 apps also fall under the DPDP Act. Most duties for businesses handling personal data apply from May 2027, and "an intern built it in an afternoon" won't be a defence. Our DPDP checklist has the dates.
The 5 checks you can run without coding
You'll only need the app's link, a phone or a private browser window, and access to the builder's account. Run these on apps your business owns, never on anyone else's.
- 01
List every app and what it holds
Ask your team one question: what have you built with an AI tool, where is it live, and what data goes in? Write down the link, the tool, the owner and the tier.
- 02
Open it logged out
Paste the link into a private window. If you see any customer name, number, order or file without logging in, switch the app off today.
- 03
Swap the ID in the address
Log in as a test user and open one record. If the address has a number or ID, change it by one. Seeing someone else's record means access rules are broken.
- 04
Check project and share settings
In Lovable, Bolt, Replit or v0, confirm the project is private, and remove old share links and ex-staff. A public project can expose code even if the app looks fine.
- 05
Ask for the database report
If it uses Supabase, open the project's Security Advisor. Any table without RLS, or a warning in red, goes to a developer before the app stays live.
Each check takes five to ten minutes. If an app fails check 2 or 3, treat it as a leak, not a bug: switch it off, fix it, and think about who may have seen the data.
How do you ask the AI to fix it without breaking more?
Ask it to explain before it changes anything. Here's a prompt we use:
"Before you change any code: list every table in this app, who can read and write each one right now, and every secret key and where it is stored. Then propose Row Level Security rules so each user can only see their own rows. Do not apply anything until I approve."
Then test again with checks 2 and 3. AI tools often "fix" a security problem by changing the screen, so the data looks hidden but is still reachable. A check you can repeat yourself is worth more than the AI telling you it is fixed. For a deeper list (secrets, logins, payments, backups, monitoring), use our production checklist for AI-built apps, which has 73 checks.
Should your business stop vibe coding?
No, and we don't think you should. Vibe coding is the fastest way we know to get a prototype in front of customers, and for tier 1 and 2 tools it is often all you need. The mistake is letting a prototype quietly become a system that holds customer data, with nobody deciding that it should.
Set one rule in your team: anything that will hold customer data gets checked before it goes live. Apps nobody approved are a form of "shadow AI", and our shadow AI audit shows how to find the rest. If you are weighing whether to rebuild properly, what you are really paying a developer for when AI writes the code explains where the money goes.
Want someone to check your app?
Our AI audit (₹10,000 or $100) reviews an AI-built app or automation for the problems above: open tables, exposed keys, broken access rules and risky settings, and tells you in plain words what to fix first. If it needs rebuilding, our pricing shows what a properly built version costs. Book a call and send us the link. To learn to build safely yourself, the Autopilot Studio course covers it.
