Your vibe-coded website is open for business to hackers.

The vulnerabilities

What vibe-coding tools don't tell you they left in.

AI code generators optimise for "works on my machine." They don't optimise for what happens when someone malicious visits yours.

1. 01

   Exposed API keys

   Hardcoded secrets sitting in your frontend JavaScript, visible to anyone who opens DevTools. Your Stripe key. Your OpenAI key. Your database URL.

   Critical

2. 02

   Broken authentication

   Password resets with predictable tokens, no brute-force protection, JWT secrets that ship as "your-secret-here", directly from AI-generated boilerplate.

   Critical

3. 03

   Unprotected admin routes

   Route guards that only hide buttons, not the underlying API calls. Your admin panel is one direct URL away from any curious visitor.

   Critical

4. 04

   SQL injection gaps

   User input passed directly into database queries. A five-minute attack can dump your entire database, or delete it.

   High

5. 05

   Misconfigured CORS

   Wildcard origins that allow any website to make authenticated requests on behalf of your users. Classic AI-generated shortcut.

   High

6. 06

   No rate limiting

   Login forms, contact submissions, and checkout flows with no throttling. Automated bots can hammer them thousands of times per second.

   Medium

What you prompted vs what shipped

The gap between vibe and reality.

You asked for "a login system." Here's what the AI often builds and why it matters.

// .env.local, committed to GitHub
STRIPE_SECRET_KEY=sk_live_9xKjd82...
DATABASE_URL=postgres://admin:pass...

// auth.js
const JWT_SECRET = "your-secret-here"

// api/users.js
const query = `SELECT * FROM users WHERE email='${req.body.email}'`

// middleware.js
app.use(cors({ origin: "*" }))

// Secrets in env, never in git
STRIPE_SECRET_KEY=loaded from vault
DATABASE_URL=loaded from vault

// auth.js
const JWT_SECRET = crypto.randomBytes(64)

// api/users.js (parameterised)
const query = `SELECT * FROM users WHERE email = $1`, [email]

// middleware.js
app.use(cors({ origin: allowedDomains }))

The Kickass Online framework

Four things every site gets judged on.

Speed, search, sales and security, the four Ss. Fix one and the others move.

1. 01

   Speed

   A vibe-coded site often bloats itself with redundant dependencies, unoptimised assets, and render-blocking scripts. Every second of load time costs you customers.

   Core Web Vitals

2. 02

   Search

   AI-generated sites frequently have no semantic HTML, broken meta tags, missing structured data, and duplicate content patterns that tank your rankings before you've launched.

   Technical SEO

3. 03

   Sales

   A default template guides nobody to a decision. The page structure, the copy and the funnel have to do that.

   CRO + UX

4. 04

   Security

   The one people discover too late. A breach costs money, trust and rankings, and sometimes the business.

   The one you're here about

The numbers

43%

Of cyberattacks target small businesses

95%

Of breaches are caused by human error

£3.4k

Average cost of a breach for SMEs

12+

Years fixing other agencies' mistakes

Free download

The vibe-coded website security checklist.

Eighteen checks you can run today, in one PDF with no upsell.

Go deeper

Want us to run it for you?

We'll audit your website across all 4 Ss, Speed, Search, Sales, and Security, and give you a prioritised action plan with no agency jargon. Done in 5 working days.