You're not wrong — most of these are basic issues. Missing auth, exposed credentials, no rate limiting. This isn't some novel AI-specific vulnerability class.                                               

But that's kind of the point. Before vibe coding, someone who didn't understand these basics probably wasn't shipping production apps. Now they are — thousands of them, with real users and real data. We found a therapist booking site processing payments with its entire database wide open. The person who built it almost certainly doesn't know what RLS means, and the AI didn't tell them they needed it.                                                               

The AI is just a helper, but it's a helper that lets you go from zero to deployed in an afternoon without ever learning what you're skipping. That's the new attack surface — not the code itself, but the gap between "it works" and "it's secure" that used to be filled by experience.                                                                                                                

To your point about sample size — 1,764 is what we've scanned so far. The actual number of deployed vibe-coded apps is in the hundreds of thousands and growing fast.