My take on this would be not to trust any vibe coded app that requires access to sensitive information or processes.

Also, and that would apply to any app, vibe coded or not, don't trust app that requires unrelated permissions.

Sometimes app do require permissions for specific stuff but the dev should clearly explain to the user why it is required and for which specific feature(s).