How AI-built apps get breached
We don't have customer case studies yet - we're early, and we won't invent them. Instead, here are real, documented public incidents that show exactly the failure mode Silker is built to stop.
AI generates the app
The tool ships working UI fast - and skips secure defaults. RLS off, keys in the bundle, no auth on routes.
It goes live
The app is deployed publicly. The database is one HTTP call away from the internet.
Someone pokes it
A curious user (or a bot) tries the anon key against the database, or calls an API route without a token.
Data walks out
Records, credentials and PII are read or exported. The founder finds out from a tweet - or a breach report.
Documented public incidents
A social app, breached within days of launch
A vibe-coded social network launched fast and was breached almost immediately - roughly 1.5M API auth tokens and 35k email addresses exposed through a Supabase database shipped with Row-Level Security disabled. No sophisticated attacker required.
Moltbook breach, 2026API keys sitting in the browser bundle
In an audit of live AI-built apps, ~60% of Lovable apps exposed an API key directly in the client bundle, and over half had no authentication on sensitive routes - the default output of the tool, shipped straight to production.
vibeAudit research, 2026“This is not hacking. This is five API calls.”
A researcher found every Lovable project created before a certain date had been exposed for 48 days - any free account could read the source code, database credentials and customer data of other projects. The exploit was trivial.
Lovable security disclosure, 2026Where Silker fits
- A free scan tells you, in plain language, if your database is open or your keys are exposed - before you launch.
- The runtime guard (SDK, Cloudflare Worker or Docker proxy) blocks abuse and data leaks live, instead of emailing a report after the fact.
- Continuous monitoring re-checks your app and alerts you when something new breaks.