Aggregated, anonymized data
State of vibe coding security
Statistics computed across every Vetora scan. No URL or site is ever identified here — only global counts.
92
Scans analyzed
172
Findings detected
5%
Have ≥1 critical finding
Score distribution
A
55% (51)
B
12% (11)
C
23% (21)
D
4% (4)
F
5% (5)
Comparison by tool
Bolt.new and Lovable only — the only tools Vetora can automatically detect from the shipped code (v0 and Cursor leave no exploitable signature).
Bolt.new
Not enough data yet (0 scans)
Lovable
Not enough data yet (0 scans)
Findings by category
Sécurité de base
84%
Stripe & Supabase
0%
Patterns vibe coding
14%
Infrastructure
2%
Dépendances (CVE)
0%
Exploitation active (domaine vérifié)
0%
Most frequent findings
#1Header de sécurité manquant : X-Frame-Options
25×#2Cookie sans flag Secure
19×#3Header de sécurité manquant : Content-Security-Policy (CSP)
17×#4Header de sécurité manquant : Permissions-Policy
15×#5Cookie sans attribut SameSite
15×#6Header de sécurité manquant : Strict-Transport-Security (HSTS)
14×#7Cookie sans flag HttpOnly
14×#8Header de sécurité manquant : X-Content-Type-Options
10×Is your app part of these numbers?
The only way to know is to scan. Free, under 30 seconds.
Scan my app