{"id":1929,"date":"2025-05-31T14:30:34","date_gmt":"2025-05-31T14:30:34","guid":{"rendered":"https:\/\/musictechohio.online\/site\/problem-vibe-coding\/"},"modified":"2025-05-31T14:30:34","modified_gmt":"2025-05-31T14:30:34","slug":"problem-vibe-coding","status":"publish","type":"post","link":"https:\/\/musictechohio.online\/site\/problem-vibe-coding\/","title":{"rendered":"Companies Are Discovering a Grim Problem With “Vibe Coding”"},"content":{"rendered":"
\n
Lovable, a \"vibe coding\" app that allows anybody to build websites with AI, has a huge cybersecurity problem.<\/div>\n

Lovable, a so-called “vibe coding” app that allows practically anybody to build websites and apps by using natural language by harnessing the power of artificial intelligence, has a huge cybersecurity problem.<\/p>\n

As Semafor<\/em> reports<\/a>, a critical security flaw has remained unfixed for months, allowing practically anyone to access critical information about the site’s users, including names, email addresses, and even financial information.<\/p>\n

In March, Matt Palmer, a staffer at AI coding assistant company Replit, wrote a report finding that 170 out of 1,645 Lovable-created web apps were suffering from the same glaring security flaw, easily allowing hackers to get away with highly sensitive information.<\/p>\n

But the bug seemingly hasn’t been meaningfully addressed.<\/p>\n

“Lovable later introduced a ‘security scanner,’ but it merely checks for the existence of any [row level security] policy, not its correctness or alignment with application logic,” Palmer tweeted on Thursday<\/a>. “This provides a false sense of security, failing to detect the misconfigurations that expose data.”<\/p>\n

Row-level security (RLS) is the “practice of controlling access to data in a database by row, so that users are only able to access the data they are authorized for,” per security firm NextLabs<\/a>.<\/p>\n

Palmer and his colleagues discovered the email addresses of roughly 500 users who had engaged with a Lovable-created website that turns a LinkedIn profile into a webpage.<\/p>\n

Software engineer Daniel Asaria claimed<\/a> that he was able to infiltrate multiple “top launched” Lovable sites, extracting personal debt amounts, home addresses, API keys, and “spicy prompts” in a matter of just 47 minutes.<\/p>\n

“This isn’t a breach story (I reported it), this is a wake-up call,” Asaria tweeted in April. “Be cautious which ‘vibe coder’ you trust with your personal data.”<\/p>\n

Following three months of<\/a> “no meaningful remediation or user notification from Lovable,” Palmer and his colleagues made their discovered bug public<\/a> on the National Vulnerabilities Database.<\/p>\n

“This is the single biggest challenge with vibe coding,” veteran software developer Simon Willison told Semafor<\/em>. “The most obvious problem is that they\u2019re going to build stuff insecurely.”<\/p>\n

Lovable founder Anton Osika, however, accused Replit’s CEO Amjad Masad<\/a>, who pointed out that Lovable makes it “too easy to expose private data,” of being jealous for having been overtaken in “usage and making vibe coding secure.”<\/p>\n

It’s truly a sign of the times, with experts warning for years now that AI coding tools could easily introduce a litany of errors<\/a> that could easily be overlooked. Researchers have also found that many of the most advanced AI models simply don’t have what it takes<\/a> to solve the majority of coding tasks.<\/p>\n

The trend has some uncomfortable implications for the programming industry as a whole, with young coders starting to heavily rely on AI tools<\/a> \u2014 which could greatly undermine their foundational knowledge, often gleaned from difficult and manual problem-solving.<\/p>\n

Lovable has since pushed back on X-formerly-Twitter<\/a>, claiming that it’s “now significantly better at building secure apps than a few months ago and this is improving quickly.”<\/p>\n

“That being said, we\u2019re not yet where we want to be in terms of security and we\u2019re committed to keep improving the security posture for all Lovable users,” the company wrote.<\/p>\n

More on AI coding:<\/strong> Advanced OpenAI Model Caught Sabotaging Code Intended to Shut It Down<\/a><\/em><\/p>\n

The post Companies Are Discovering a Grim Problem With “Vibe Coding”<\/a> appeared first on Futurism<\/a>.<\/p>\n<\/div>\n

<\/div>","protected":false},"excerpt":{"rendered":"

Lovable, a so-called “vibe coding” app that allows practically anybody to build websites and apps by using natural language by harnessing the power of artificial intelligence, has a huge cybersecurity…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1176,177,1177,1178],"tags":[],"class_list":["post-1929","post","type-post","status-publish","format-standard","hentry","category-ai-code","category-artificial-intelligence","category-cybersecurity","category-vibe-coding"],"_links":{"self":[{"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/posts\/1929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/comments?post=1929"}],"version-history":[{"count":0,"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/posts\/1929\/revisions"}],"wp:attachment":[{"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/media?parent=1929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/categories?post=1929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/musictechohio.online\/site\/wp-json\/wp\/v2\/tags?post=1929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}