{
  "id": 3254056,
  "title": "I scanned 1,049 AI-built apps. 71 got flagged for the same mistake. Here's how many were actually real.",
  "url": "https://urgent.news/2026/08/25/i-scanned-1-049-ai-built-apps-71-got-flagged-for-the-same-mistake",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-25T11:45:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/holistis/i-scanned-1049-ai-built-apps-for-one-known-mistake-71-had-it-heres-what-i-did-next-331d"
  },
  "original_language": "en",
  "account": "In a recent study, researcher Abdellah MergeFix scanned 1,049 AI-built applications for a common security issue. Out of the total, 71 applications were flagged initially by the automated scan, representing approximately 6.8% of the total. However, after manual review, it was determined that 40 of these flagged applications were intentionally public and did not contain any private data. This left 31 applications, or about 3% of the total, with actually private data that could be accessed by anyone without requiring a login. These applications contained sensitive information such as account profiles, private messages, paid usage history, and in one case, a full database master key that granted full access to the application. MergeFix reached out to the companies behind these 31 applications, individually contacting them to inform them of the issue and provide guidance on how to fix it. The researcher emphasized the importance of disclosing vulnerabilities and taking action to protect user data, rather than simply reporting the number of applications affected. He also pointed out that fast development using AI tools often leads to overlooking important security considerations, and that this issue is not unique to AI-generated apps but is a broader problem affecting many applications.",
  "summary": "I scanned 1,049 AI-built apps. 71 got flagged for the same mistake. Here's how many were actually real. Vibe coding has a security problem. That's not news anymore. Wiz found it in Moltbook back in February. Forbes wrote about it in March. The Verge covered it in June. Security researchers have been scanning Supabase-backed apps at scale for most of 2026, and the numbers keep landing in the same…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}