Two stories dropped this week that look different on the surface but are the same story underneath. Supabase customers are publicly exposing personal data because AI-generated and vibe-coded apps skip the configuration step that a trained developer would never skip. Separately, Meta's Muse exposed its own filesystem to curious users who poked at it with the right prompts. Neither of these is a hack. Both are the product of the same instinct: ship first, secure never.
What Vibe Coding Actually Costs
The phrase 'vibe coding' sounds playful, like a design ethos. It is not. It is a production practice where the vibe is the specification, and the AI fills in the rest. The problem is that security is procedural, not intuitive. A 2023 paper in IEEE Security and Privacy by Sandoval et al. found that code generated by large language models introduced security vulnerabilities at a significantly higher rate than human-written code, particularly around authentication and data exposure. That paper arrived before the current generation of AI coding assistants. The problem has not gotten smaller. Kiteworks urging customers to shut down servers amid an imminent threat arrives in the same week, adding a third data point to what is starting to look like a pattern, not a coincidence.
The Gap Between Builder and Operator
What unites Supabase, Muse, and Kiteworks is a structural problem that no amount of better prompting fixes: the person building the app and the person responsible for its security are increasingly the same person, and that person is increasingly an AI. Mark Zuckerberg argued this week that Meta glasses are more transparent than phone cameras because they have a light. The argument is a tell. The industry is in the phase where it defends the symptom instead of addressing the system. Eugenia Kuyda's framing of personal software as something you raise like a garden starts to sound less utopian and more diagnostic. Gardens grow wild when nobody tends them. So do databases.