We stay ahead so you don't have to. 

Many apps make a little preview image for links shared on social media. In Next.js 16.2 through 16.3.5, if that image includes words a visitor can control, such as a name from the web address, a visitor can hide code in those words and run it on your server. Vercel rates it critical. Apps hosted on Vercel were protected; apps hosted elsewhere were not.Satori, which turns the ImageResponse layout into SVG, did not escape certain attacker-controlled values, so a crafted value is parsed as SVG and can reach other dependencies. Affects 16.2.0 to 16.3.5 on the Node runtime; Edge and 15.x unaffected. CVSS 9.5 (Vercel) against 5.3 (Satori). Fixed in 16.3.6 and hardened in 15.5.26.

Affects: Next.js 16.2 to 16.3.5 · Social preview images · Self-hosted apps

Spotted by Vercel security release; reported by The Hacker News · CVE-2026-94545

Sources: https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html · https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-148/ · https://cyber.gc.ca/en/alerts-advisories/nextjs-security-advisory-av26-851

Researchers watched the traffic of 444 AI chat apps. 282 handed over paid AI access in one of three ways: the secret key sat in the traffic in plain sight (54 apps), the app's own server answered anyone who asked, with no login (92 apps), or a "temporary" pass that never really expired could be copied and reused (136 apps). One token was set to expire in the year 2125. Three months after being told, only 28% had fixed it.Plaintext keys in requests (54 apps, 28 also leaking the system prompt), unauthenticated backend relays (92), and replayable or long-lived tokens (136; one expiring in 2125, one "one-hour" token valid 128 days later). At least ten providers, OpenAI most common. Sysdig's worst-case LLMjacking figure: more than $46,000 a day.

Affects: Any app that calls OpenAI, Gemini or Anthropic · Web and mobile · Lovable, Bolt and v0 defaults

Spotted by Researchers at Wake Forest University (LLMKeyLens)

Sources: https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html · https://arxiv.org/abs/2606.12212

Your app is built from hundreds of small code packages other people publish. Six of them were poisoned: installing one ran a hidden script that copied your secrets file, cloud logins, SSH keys and browser passwords, then used your own publishing rights to poison more packages. It also tried to spread to Python.postinstall hooks exfiltrate .npmrc, .env, SSH keys, .git-credentials, AWS, GCP and Azure credentials, Kubernetes and Docker configs, Terraform and Vault material and browser credentials to an ICP canister and an HTTPS webhook, then publish new poisoned versions with the stolen npm tokens. PyPI propagation through .pth payloads. Six packages named, including pgserve 1.1.11 to 1.1.14.

Affects: Every JavaScript project · CI servers · Developers' laptops

Spotted by Socket and StepSecurity · CanisterSprawl

Sources: https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html · https://thenewstack.io/npm-supply-chain-worm-attack/

Anyone with a free Lovable account could open other people's projects: the source code, the database passwords written into it, the AI chat history, and users' personal details. It was reported on 3 March, fixed for new projects, and left open for existing ones for 48 days. Lovable first said it was "intentional behaviour", then partly apologised.Broken object-level authorisation in Lovable's API: five calls from any free account reached another user's profile, source and database credentials. Patched for new projects only; projects created before November 2025 stayed exposed. A follow-up report was closed as a duplicate by bounty triage.

Affects: Lovable projects from before November 2025 · Supabase keys written into code

Spotted by An independent researcher; reported by TNW · BOLA in the platform API

Sources: https://thenextweb.com/news/lovable-vibe-coding-security-crisis-exposed

A popular exam-grading app built on Lovable had no protection on its database. Anyone, without logging in, could read every user record, delete accounts, grade other people's tests and send bulk emails. One login check even worked backwards: it blocked people who were logged in and let strangers through. 18,697 records, including 4,538 students.Supabase backend without RLS or role checks. An RPC-based auth function had inverted logic, blocking authenticated users and admitting anonymous ones, repeated across several critical functions. 18,697 records: 14,928 unique emails, 870 with full PII. The support ticket was closed without a response; Lovable says it acted within minutes of a formal disclosure.

Affects: Supabase apps · Lovable, Bolt and v0 defaults

Spotted by Taimur Khan; reported by The Register

Sources: https://www.theregister.com/2026/02/27/lovable_app_vulnerabilities · https://cybernews.com/security/lovable-ai-apps-expose-personal-information/

AI tools like Cursor and Claude Code connect to small helper programs called MCP servers. Over 30 holes were reported in two months: helpers that run commands they're told to by hidden text, helpers with no login at all, and fake helpers that quietly copy your keys. Earlier cases leaked WhatsApp chats and private GitHub code.Shell and exec injection 43%, tooling flaws 20%, auth bypass 13%, path traversal 10%. Of 2,614 implementations, 82% had traversal-prone file operations. Named: mcp-remote CVE-2025-6514 (CVSS 9.6), Cursor MCPoison CVE-2025-54136, GitHub MCP prompt injection through public issues, Smithery isolation traversal, Postmark impersonation.

Affects: Cursor, Claude Code and Windsurf users · Any project with an MCP config

Spotted by A roundup of CVEs and vendor disclosures · 30+ CVEs

Sources: https://heyuan110.com/posts/ai/2026-03-10-mcp-security-2026 · https://www.practical-devsecops.com/mcp-security-vulnerabilities/

Researchers scanned about 130,000 websites built with 13 AI app builders. Roughly 26,000 had at least one secret key sitting where any visitor could read it: keys for OpenAI, Gemini, Stripe, Razorpay, Telegram bots and Airtable, and over 16,000 Firebase and 3,000 Supabase database credentials. Gemini keys made up almost three-quarters of the AI keys found, and more than 300 of them worked.About 130k sites across 13 platforms; about 26k with at least one leaked secret; about 25k unique secrets after filtering low-entropy values. Bearer tokens 25%, OpenAI 12%, reCAPTCHA 8%, ElevenLabs 7%, Razorpay key IDs 4.5%, Stripe 1.9%. Gemini 72% of AI secrets; 300+ Google keys validated against Gemini APIs. Server-side exposures were excluded, so this is a floor.

Affects: Apps from any AI builder · Firebase and Supabase apps · Anything with a Gemini or OpenAI key

Spotted by RedHunt Labs (Project Resonance, Wave 15)

Sources: https://redhuntlabs.com/blog/echoes-of-ai-exposure-thousands-of-secrets-leaking-through-vibe-coded-sites-wave-15-project-resonance/ · https://cyble.com/blog/when-ai-secrets-go-public-chatgpt/