--- title: "VibeSec (@vibesec) | Hashnode" description: "45% of AI-generated code ships with a vulnerability 馃敁 We built the scanner that catches the ones most tools miss. Now we write about what's" url: "https://hashnode.com/@vibesec" --- @vibesec # VibeSec @vibesec 路 New York, USA 路 Joined July 2026 45% of AI-generated code ships with a vulnerability 馃敁 We built the scanner that catches the ones most tools miss. Now we write about what's [Website](https://ismysitehackable.com/) ### [Cursor AI Hack, Nuxt RCE](https://ismysitehackable.hashnode.dev/cursor-ai-hack-nuxt-rce?utm_source=hashnode&utm_medium=feed) Cursor AI was used to breach seven companies, Nuxt patched a high-severity RCE, and a model reached a live database unsupervised. Here's what it means for your app. 4 min read 路 [ismysitehackable.hashnode.dev](https://ismysitehackable.hashnode.dev/cursor-ai-hack-nuxt-rce?utm_source=hashnode&utm_medium=feed) [Aug 28](https://hashnode.com/posts/cursor-ai-hack-nuxt-rce/6a91e0f247269e9d1170d675) ### [When AI Agents Deploy Your Code Themselves](https://ismysitehackable.hashnode.dev/when-ai-agents-deploy-your-code-themselves?utm_source=hashnode&utm_medium=feed) Vercel's MCP now deploys code, DeepSQL gives agents database access, and OneCLI tries to keep secrets away from AI coding agents. What it means for your app. 5 min read 路 [ismysitehackable.hashnode.dev](https://ismysitehackable.hashnode.dev/when-ai-agents-deploy-your-code-themselves?utm_source=hashnode&utm_medium=feed) [Aug 24](https://hashnode.com/posts/when-ai-agents-deploy-your-code-themselves/6a8c836fb9c3cb4223dc0ea4) ### [An Auth Bypass and Agents With Wallets](https://ismysitehackable.hashnode.dev/an-auth-bypass-and-agents-with-wallets?utm_source=hashnode&utm_medium=feed) A Firebase auth bug let anyone log in as admin. Vercel agents can now make purchases. What today's vibe-coding security news means for your shipped app. 5 min read 路 [ismysitehackable.hashnode.dev](https://ismysitehackable.hashnode.dev/an-auth-bypass-and-agents-with-wallets?utm_source=hashnode&utm_medium=feed) [Aug 22](https://hashnode.com/posts/an-auth-bypass-and-agents-with-wallets/6a89bbf06e1aad2acaa232a0) ### [n8n's Supabase Bug: What It Means for Your App](https://ismysitehackable.hashnode.dev/n8n-s-supabase-bug-what-it-means-for-your-app?utm_source=hashnode&utm_medium=feed) An n8n filter injection bug turned single-row Supabase queries into full-table exposure. Here's what vibe coders should check in their own AI-built apps today. 6 min read 路 [ismysitehackable.hashnode.dev](https://ismysitehackable.hashnode.dev/n8n-s-supabase-bug-what-it-means-for-your-app?utm_source=hashnode&utm_medium=feed) [Aug 21](https://hashnode.com/posts/n8n-s-supabase-bug-what-it-means-for-your-app/6a8863af98ac1837b0b0856f) ### [Next.js Security Release: What Vibe Coders Need to Know](https://ismysitehackable.hashnode.dev/next-js-security-release-what-vibe-coders-need-to-know?utm_source=hashnode&utm_medium=feed) Next.js shipped 13 security fixes including CVE-2026-23870, plus new Vercel safeguards. See what changed and what vibe-coded apps should update this week. 5 min read 路 [ismysitehackable.hashnode.dev](https://ismysitehackable.hashnode.dev/next-js-security-release-what-vibe-coders-need-to-know?utm_source=hashnode&utm_medium=feed) [Aug 20](https://hashnode.com/posts/next-js-security-release-what-vibe-coders-need-to-know/6a86fe909d6870b7fbf0002c)