Vibe coding: Is your AI-built app really secure?

A client portal, an internal dashboard, a tool to manage employee requests: what used to take weeks of development can now sometimes be built in an afternoon. This is what's known as vibe coding: describing what you want to an AI, using platforms like Lovable, Bolt or Replit, and letting it generate the code.

At MMO Techno, we encourage our clients to experiment with these tools. They help solve problems that would otherwise have gone unaddressed for lack of budget or time. But one question often comes up too late: is the application as secure as it is functional?

A working app isn't necessarily a secure app

An application can have a polished interface and a login page, and still leave its data within anyone's reach. These flaws don't show up on screen. The person who built the app often doesn't know they exist.

This isn't theoretical. In 2025, a researcher found that more than 170 apps built with Lovable had data access control issues (CVE-2025-48757). Insufficient access rules could allow unauthorized people to read or modify data. The potentially exposed information included names, email addresses, phone numbers and API keys (Superblocks).

The most common mistakes tend to repeat:

• Authentication that's easy to bypass.
• APIs that respond without checking permissions.
• A database directly reachable from the Internet.
• API keys or passwords left in the code.
• Outdated or misconfigured dependencies.

Once an application is online, automated tools can find and analyze it. Even a small tool used by five employees can become an entry point.

In Quebec, it's also a Law 25 issue

If your application contains personal information (clients, employees, patients), a flaw isn't just a technical problem. Under Quebec's Law 25, a confidentiality incident includes unauthorized access to, use or disclosure of personal information, its loss, or any other breach of its protection.

In practice, when an incident occurs, the business must:

• Take reasonable measures to reduce the risk of injury and prevent a similar incident from happening again.
• Notify the Commission d'accès à l'information and the affected individuals if the incident presents a risk of serious injury.
• Record the incident in a register, even when it doesn't present a risk of serious injury, and keep the required information for at least five years.

A tool built in an afternoon can therefore lead to legal obligations, client notifications and reputational damage. One of the first steps to consider is not exposing the application to the Internet unnecessarily.

Why expose an internal app to the entire Internet?

Consider a typical case. A company uses AI to build a tool that lets employees look up client files. The app works, it has a login page, and it goes online. Only five people need to use it, but it's publicly accessible on the Internet.

This is where Zero Trust Network Access (ZTNA) comes in. The principle is simple: control who can reach an application before allowing them to communicate with it.

For businesses already using Microsoft 365, Microsoft Entra is often the most natural choice: depending on the application's architecture, Entra application proxy or Entra Private Access. Employees sign in with their usual account and Conditional Access policies apply. Cloudflare Access and Zscaler Private Access are also good options, depending on the environment.

Once in place, these solutions let you:

• Limit access to authorized employees and groups.
• Require multifactor authentication (MFA).
• Block anonymous visitors before they reach protected resources.
• Quickly revoke access when an employee leaves the company.

With an application properly isolated behind these controls, an anonymous attacker can no longer directly reach the protected features to try to exploit their vulnerabilities.

What Zero Trust doesn't do

ZTNA significantly reduces exposure, but it doesn't fix the code. The application remains vulnerable to authorized users, compromised accounts and configuration errors.

Above all, it only protects what goes through it. If the application and its API are hosted behind the barrier, everything is covered. But many vibe coding platforms connect the application to a cloud database (such as Supabase) that the browser queries directly over the Internet. That database then remains reachable through another path, regardless of the protection in front of the web page. That's exactly what happened with the Lovable apps.

Zero Trust is therefore an additional layer of protection, not a substitute for good development practices and security reviews.

5 questions to ask before putting an app online

1. Does the application really need to be public? If it's only for employees, it's generally better to restrict access.
2. Can it be placed behind a Zero Trust solution? Microsoft Entra, Cloudflare Access or Zscaler Private Access, depending on the environment and the application's architecture.
3. Do users sign in with their work account and MFA? A centralized identity managed by the company makes it easier to enforce security policies and revoke access.
4. Are the database, APIs and keys protected too? Blocking the web page isn't enough if the services behind the application remain accessible without authorization.
5. Has anyone reviewed the code's security? Permissions, input validation, dependencies and configurations: a security review catches problems the interface doesn't reveal.

Many of these measures can be put in place quickly when they're planned from the start. Fixing an application once it's in production is often far more complex and costly.

Innovate fast, without opening the door

AI now lets almost anyone build an application. That's great news, and at MMO Techno, we want our clients to take full advantage of it. But encouraging innovation also means making sure the tools being built don't become new entry points for cyberattacks.

An application that doesn't need to be public shouldn't be. And when it does need to go online, its security should be part of the project from the start, just like its features.

Have you built, or are you planning to build, an application with AI? MMO Techno can assess its security and Internet exposure, then put access controls in place that fit your environment, including with Microsoft Entra, Cloudflare Access or Zscaler.

Email us at support@mmotechno.com or call 1-855-532-0189.