Scan launched vibe-coded apps for leaked keys and missing security headers
ShipSniffer collected 155 vibe-coded apps launched on Show HN and ran a free passive scan on the 99 still live, checking HTML and JavaScript bundles for secret keys, security headers and Supabase settings.
Source
jakecyr on Hacker News · 2026-10-17 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-18.
What they did
ShipSniffer collected 155 vibe-coded apps launched on Show HN and ran a free passive scan on the 99 still live, checking HTML and JavaScript bundles for secret keys, security headers and Supabase settings.
Result (as claimed)
91% had no Content-Security-Policy, 88% could be framed by any site, 37% exposed a Supabase anon key, and only 1 app leaked a secret key (an OpenAI key).
Tools they used
Cost: Lovable: free plan, paid from $25/mo; Replit: free plan, paid from $18/mo; Cursor: free plan, paid from $8/mo. Checked 2026-10-14.
Set it up
Gather your sources
Collect the papers, notes, links or files you want to work from in one place.
Load them into the tool
Open Lovable, Replit, Cursor and add your sources. Keep the original files so you can check claims later.
Ask focused questions
Ask for summaries, comparisons or connections with citations to the source passages.
Verify and save
Spot check claims against the sources, then save the output as notes you can reuse.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Scan launched vibe-coded apps for leaked keys and missing security headers What the original author did: ShipSniffer collected 155 vibe-coded apps launched on Show HN and ran a free passive scan on the 99 still live, checking HTML and JavaScript bundles for secret keys, security headers and Supabase settings. Reported result (as claimed by the author): 91% had no Content-Security-Policy, 88% could be framed by any site, 37% exposed a Supabase anon key, and only 1 app leaked a secret key (an OpenAI key). Source: https://news.ycombinator.com/item?id=50133249 Tools they used: Lovable, Replit, Cursor Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Scan launched vibe-coded apps for leaked keys and missing security headers What the original author did: ShipSniffer collected 155 vibe-coded apps launched on Show HN and ran a free passive scan on the 99 still live, checking HTML and JavaScript bundles for secret keys, security headers and Supabase settings. Reported result (as claimed by the author): 91% had no Content-Security-Policy, 88% could be framed by any site, 37% exposed a Supabase anon key, and only 1 app leaked a secret key (an OpenAI key). Source: https://news.ycombinator.com/item?id=50133249 Tools they used: Lovable, Replit, Cursor Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Scan launched vibe-coded apps for leaked keys and missing security headers What the original author did: ShipSniffer collected 155 vibe-coded apps launched on Show HN and ran a free passive scan on the 99 still live, checking HTML and JavaScript bundles for secret keys, security headers and Supabase settings. Reported result (as claimed by the author): 91% had no Content-Security-Policy, 88% could be framed by any site, 37% exposed a Supabase anon key, and only 1 app leaked a secret key (an OpenAI key). Source: https://news.ycombinator.com/item?id=50133249 Tools they used: Lovable, Replit, Cursor Category: Research & learning Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
How to vibe code an app with Claude Code · How to secure vibe-coded apps and agents · How to use Cursor agents and automations
Related use cases
Browse 120+ vibe-coded apps in a gallery that updates from X
Built a gallery of 120+ real apps people shipped with Cursor, Lovable, Bolt, Claude Code, Replit and v0 that updates itself from X.
Build client apps and automations solo while keeping a full-time job
After 12 years in management he started coding again with Cursor, Lovable, Claude Code and Codex. In two years he built more than 20 apps and automation projects for local clients, including a career tool, a startup and business agents, without the offshore team he once hired.
Audit a vibe-coded app for leaked secrets, missing RLS and dead buttons
Vibe Aegis v2.0 is an open-source safeguard and adversarial audit loop that runs in one command across Claude Code, Codex and Cursor. It targets what agents often ship: exposed NEXT_PUBLIC_ secrets, tables without row-level security, IDOR bugs, client-trusted checkout prices, double-spend race conditions and dead placeholder links.
Find vibe-coded apps that already make money with an automatic X tracker
PromptShipped scans X automatically for vibe-coded apps that are earning money. One example it found is ATC7700, a free air-traffic-control sim whose maker says it is all vibe coded and already has two advertisers.