What common security problems does Reeve find in vibe-coded apps?

Reeve's published scan data shows that almost every AI-built app it checked had at least one issue. Across 30,998 live vibe-coded apps, 99% had at least one problem. The most common finding was missing security headers (99% of apps, up to Medium severity), followed by cross-site sharing (22%, up to High), exposed source maps (13%, up to Medium), database access (8%, up to Critical), and exposed secrets (4%, up to Critical). These numbers come from an automated external check, not a full audit, so treat them as a signal of how widespread each issue is rather than a verdict on any single app.

The five findings, in order of how often they show up

The pattern worth noticing: the two most frequent problems are also the least severe, and the two rarest are the ones that can expose everything. Frequency and risk don't move together here.

Security headers (99%, up to Medium)

Nearly every app was missing some protective response headers. This is a low-effort fix and rarely the thing that sinks an app on its own, but it's the baseline almost nobody hits.

Cross-site sharing (22%, up to High)

Roughly one in five apps had sharing configurations that let other origins reach data they shouldn't. This sits in the middle of the severity range and is easy to overlook because the app still works fine.

Source maps (13%, up to Medium)

About one in eight apps shipped source maps that expose original code. Not a data leak by itself, but it hands an attacker a map of your app.

Database access (8%, up to Critical)

This is where the stakes jump. Among the 3,680 apps where Reeve could actually reach a Supabase database, 57% had tables a stranger could read. That's the finding behind Reeve's framing that a broken front end costs you a customer while an open database costs you all of them — user data lives in this layer, and one misconfiguration can expose all of it at once.

Exposed secrets (4%, up to Critical)

The rarest finding, and one of the two Critical ones. A secret key sitting in client-side code or headers means anyone who looks can use it.

Why the database number is the one to check first

The headline 8% understates the risk because it's measured against all apps. Narrow the view to apps that actually have a reachable Supabase database and the picture changes:

• 3,680 databases answered Reeve's check
• 57% of those had tables a stranger could read
• Storage buckets showed up as a problem in 17% of the Supabase apps in that sweep

If your app uses Supabase, the relevant question isn't "did I land in the 8%" — it's whether row-level security is actually on and whether your tables and storage buckets reject anonymous reads. That's a configuration question you can answer directly, not a probability.

What these numbers do and don't tell you

They're useful for one thing: knowing which problems are common enough that you should assume you have them until you check. Missing headers at 99% means you almost certainly have that one. Exposed secrets at 4% means it's unlikely but catastrophic, so it's still worth a look.

They don't tell you your app's grade. The scan is an automated external check — it sees what's reachable from outside, not your full configuration or code. Reeve's own wording is explicit that this isn't a full audit. Use the distribution to prioritize, then verify your own app's specific state rather than assuming you match the average.