These are canaries in the colemines. Platforms need better defaults, deny-by-default DBs, least-priviledge API, automated auth tests, etc. Basically make insecure deployments difficult with AI generated code.
I strongly agree! I think occurrences like these are going to be common when using platforms where we assume that creators will run security checks after the fact. In another comment here, lovable is say that app creators are culpable because they didn't take action to fix security issues.
I'm the creator of Skape - an app building platform where the security is baked into the platform itself. Login and sharing data with other users all happens in the platform. This doesn't mean "your app shows its own UI and then feeds username/password to a login service" - I mean that Skape's UI handles login, and then while you use your app, Skape routes your data requests to your database. The app is treated as untrusted by the platform, which means app creators and users have to worry a lot less about the security of vibe coded apps.
I think that this is a better approach to security that will allow users to trust the software on the skape platform to a higher degree.
I'm the creator of Skape - an app building platform where the security is baked into the platform itself. Login and sharing data with other users all happens in the platform. This doesn't mean "your app shows its own UI and then feeds username/password to a login service" - I mean that Skape's UI handles login, and then while you use your app, Skape routes your data requests to your database. The app is treated as untrusted by the platform, which means app creators and users have to worry a lot less about the security of vibe coded apps.
I think that this is a better approach to security that will allow users to trust the software on the skape platform to a higher degree.
Check it out - https://skape.run/