Vibe Coding: Build an App, Then Secure It

Collins Dictionary named "vibe coding" their Word of the Year. MIT called it a top-10 breakthrough technology. And 92% of US developers now use AI coding tools daily.

But here's the number nobody puts in the headline: 62% of AI-generated code contains security vulnerabilities. In March 2026 alone, Georgia Tech tracked 35 new CVEs caused directly by vibe-coded apps.

I'll walk you through building a real app with vibe coding — no programming experience needed. Then I'll show you the 5 security checks to run before you ship it.

You'll build: A personal bookmark manager with tags, search, and a clean UI.

You'll need: A free Lovable account (lovable.dev). That's it.

Time: About 90 minutes to build. 15 minutes to secure.

What is vibe coding?

Vibe coding means describing what you want in plain English and letting AI write the code.

You type: "Build me a bookmark manager where I can save URLs with tags."

AI gives you: a working app with a database, frontend, and deployment URL.

No syntax. No debugging semicolons. You describe the vibe, AI handles the code.

The term took off in early 2025 when Andrej Karpathy tweeted about it. By 2026, the market hit $4.7 billion. GitHub reports that 46% of all new code is now AI-generated.

Pick your tool

Four tools dominate vibe coding in 2026. Here's which one to use:

For this tutorial, we're using Lovable. It's the best starting point if you've never written code. You get a complete app with database, auth, and deployment from a single prompt.

If you're already a developer, Cursor is the better pick. But the security section at the end applies to every tool.

Step 1: Write your first prompt

Go to lovable.dev and sign up for a free account.

Here's the prompt I used. Copy it exactly:

Build a personal bookmark manager app with these features:

1. Add a bookmark: URL field, title field, and tag selector (multi-select)
2. Tag management: create, edit, and delete tags with color coding
3. Search: filter bookmarks by title, URL, or tag
4. Card layout: each bookmark shows title, URL preview, tags, and date added
5. Responsive design: works on mobile and desktop
6. Dark mode by default

Use Supabase for the database. Include user authentication
so each person sees only their own bookmarks.

Hit enter. Lovable starts generating.

In about 60 seconds, you'll see a working app in the preview panel. It's not done yet, but you have a real UI with real buttons.

Step 2: Iterate with follow-up prompts

The first generation is your starting point. Now refine it.

Here are the follow-up prompts I used, one at a time:

Prompt 2:

Add a favicon fetcher — when I paste a URL, automatically grab the
site's favicon and show it on the bookmark card.

Prompt 3:

Add an "import bookmarks" feature. Let me upload a Chrome bookmarks
HTML export file and import all bookmarks automatically.

Prompt 4:

Add keyboard shortcuts: Cmd+K to open search, Cmd+N to add new
bookmark, Escape to close modals.

Each prompt takes 30-60 seconds to generate. After 4 rounds, I had a bookmark manager with features that would take a junior developer a full week to build.

That's the magic of vibe coding. And also where the problems start.

Step 3: Connect Supabase

Lovable auto-generates Supabase code, but you need to connect your own database.

1. Go to supabase.com and create a free project
2. Copy your Project URL and anon key from Settings > API
3. In Lovable, click the Supabase integration icon
4. Paste both values

Your app now has a real database. Bookmarks persist between sessions.

This is also where the first security risk lives. That anon key is about to be embedded in your frontend code. We'll fix that in the security section.

Step 4: Deploy

Click "Deploy" in Lovable. You get a live URL in about 30 seconds.

Your app is now on the internet. Anyone with the link can see the login page. That was fast.

But "deployed" and "safe to use" are two very different things.

The security problem with vibe coding

Here's what most vibe coding tutorials skip.

Moltbook launched in January 2026 as an AI social network. The founder said he "didn't write a single line of code." Three days later, security researchers at Wiz found the app had leaked 1.5 million API tokens and 35,000 email addresses. The Supabase API key was exposed in client-side JavaScript with Row Level Security disabled.

That's not a rare edge case. Research on 5,600 publicly available vibe-coded apps found 2,000+ vulnerabilities, 400+ exposed secrets, and 175 instances of leaked personal data including medical records and bank details.

The problem isn't the AI. The AI writes code that works. It just doesn't write code that's secure. 70% of Lovable apps ship with Row Level Security disabled. The AI turns it off to avoid errors during development and never turns it back on.

5 security checks before you ship

These take about 15 minutes total. Do them every time.

Check 1: Row Level Security (RLS)

This is the #1 vulnerability in vibe-coded apps. Without RLS, anyone with your Supabase URL can read everyone's data.

Go to your Supabase dashboard > Table Editor. Click each table. Check if RLS is enabled.

If it says "RLS disabled," fix it:

-- Enable RLS on the bookmarks table
ALTER TABLE bookmarks ENABLE ROW LEVEL SECURITY;

-- Only let users see their own bookmarks
CREATE POLICY "Users see own bookmarks"
  ON bookmarks
  FOR SELECT
  USING (auth.uid() = user_id);

-- Only let users insert their own bookmarks
CREATE POLICY "Users insert own bookmarks"
  ON bookmarks
  FOR INSERT
  WITH CHECK (auth.uid() = user_id);

-- Only let users delete their own bookmarks
CREATE POLICY "Users delete own bookmarks"
  ON bookmarks
  FOR DELETE
  USING (auth.uid() = user_id);

Run these SQL statements in Supabase's SQL Editor. Replace bookmarks with each table name in your project.

Check 2: Exposed secrets

Search your codebase for hardcoded keys.

In Lovable, click "Code" to view the source. Use Cmd+F to search for:

SUPABASE_KEY
API_KEY
SECRET
PASSWORD
PRIVATE
TOKEN

If you find any values that aren't the anon (public) key, you have a problem. Service role keys, API secrets, and database passwords should never be in frontend code.

Fix: Move them to Supabase Edge Functions or environment variables.

Check 3: Input validation

Try typing this into any text field in your app:

<script>alert('hacked')</script>

If an alert box pops up, your app has an XSS vulnerability. AI-generated code often skips input sanitization.

Fix: Ask Lovable to add input sanitization:

Add input sanitization to all text fields. Escape HTML entities
on both client and server side. Use DOMPurify for any rendered
user content.

Check 4: Authentication on API routes

Open your browser's developer tools (F12 > Network tab). Use your app normally. Look at the API calls.

Do any requests work without an auth token? If you can hit an API endpoint without being logged in and get data back, that endpoint is unprotected.

Fix:

Review all Supabase queries. Make sure every query uses the
authenticated client, not the public client. No database
operation should work without a valid user session.

Check 5: Error messages

Trigger some errors in your app. Leave required fields blank. Enter a URL that doesn't exist. Try to access a page you shouldn't.

Do the error messages show database table names, column names, or stack traces? Those give attackers a map of your system.

Fix:

Replace all detailed error messages with user-friendly messages.
Never expose database schema, table names, or stack traces to
the frontend. Log detailed errors server-side only.

The 3-minute security prompt

If you want a quick fix, paste this prompt into Lovable after your app is built:

Security audit my app:
1. Enable Row Level Security on ALL Supabase tables
2. Add RLS policies so users can only access their own data
3. Remove any hardcoded API keys or secrets from client code
4. Add input sanitization to all user-facing text fields
5. Replace detailed error messages with generic user-friendly ones
6. Ensure all database queries require authentication

It won't catch everything. But it handles the top 80% of vibe coding vulnerabilities in one shot.

When vibe coding works (and when it doesn't)

Works great for:

• MVPs and prototypes you need fast
• Internal tools for your team
• Personal projects and side projects
• Landing pages and marketing sites
• Hackathon projects

Not ready for:

• Apps handling payments (use a real developer for Stripe integration)
• Healthcare or financial data (compliance requirements need human review)
• Apps with more than ~50 database tables (AI loses track of complexity)
• Anything with real-time collaboration (WebSocket handling gets messy)

The honest take: vibe coding is incredible for going from zero to working prototype. It's not a replacement for engineering when security and scale matter. Use it to validate ideas fast, then bring in professional help for production.

FAQ

What is vibe coding? Vibe coding means using AI tools to build software by describing what you want in natural language instead of writing code manually. Tools like Lovable, Bolt.new, and Cursor generate working applications from text prompts.

Is vibe coding safe? Not by default. 62% of AI-generated code contains security vulnerabilities. But you can make it safer by running basic security checks, especially enabling Row Level Security and removing hardcoded API keys from your frontend code.

Can I build a real business on vibe coding? For an MVP, absolutely. Multiple startups have launched using vibe-coded prototypes. For scaling to thousands of users, you'll likely need to bring in a developer to handle security, performance, and edge cases the AI missed.

Which vibe coding tool is best for beginners? Lovable, by a wide margin. No coding experience needed, built-in database integration, and one-click deployment. Bolt.new is second for quick prototypes. Cursor is best for developers.

How much does vibe coding cost? Most tools have free tiers. Paid plans start at $20-25/month. Compare that to hiring a developer at $100-200/hour, and the economics are clear for prototyping.

What to build next

You have a working bookmark manager. Here's what to try next:

• Add AI-powered auto-tagging (ask Lovable to "use OpenAI to suggest tags based on the URL content")
• Build a Chrome extension that saves bookmarks with one click
• Add shared collections so you can share bookmark folders with friends

Each of these is one prompt away.

The speed is real. The security gaps are real too. Build fast, check before you ship, and you'll be ahead of 70% of people vibe coding right now.

Built something with vibe coding? Found a security issue others should know about? Share it with other builders on codebrainery.com.