66 percent of developers name AI solutions that are almost right, but not quite, as their top frustration. 45 percent say debugging AI-generated code takes longer than writing it. Distrust in AI accuracy rose from 31 percent to 46 percent in a year.
Stack Overflow Developer Survey 2025
Read the source
You already feel this in code review. The function looks fine. The types line up. Then it fails on the one input you did not think about. The same thing happens at the product level, and there is no review step for it. Nobody reads the shipped product the way they read the diff.
The permission that was never set
In a March 2025 scan of 1,645 Lovable projects, 170 of them, 10.3 percent, exposed Supabase tables to unauthenticated reads through the public anon key. The issue was filed as CVE-2025-48757 with a CVSS score of 9.3. The scan was run by Matt Palmer and Kody Low as part of Replit DevRel. Lovable patched the issue in April 2025 and disputes the CVE. That figure is a percentage of projects scanned, not of endpoints.
Nothing in the build looked broken. The app worked.
mattpalmer.io, statement on CVE-2025-48757, May 2025
Read the source
What was sitting in production
Escape.tech inventoried more than 5,600 publicly reachable vibe-coded apps across 14,600 assets. They found 2,038 critical vulnerabilities, more than 400 exposed secrets, and 175 instances of exposed personal data in production, including medical records, IBANs, phone numbers and emails. The scanning was passive only. The researchers describe the result as a verified baseline, not the full picture.
Escape.tech research methodology
Read the source
Every one of those apps passed the only test it was given. It loaded.