From Enrichlead to Moltbook: A Short Tour of the Vibe-Coded Graveyard

Every story below is public and linked to a dated source you can check. We left out the anonymous horror stories that circulate on social media. You can't learn much from an incident nobody can verify, and you can't show it to your cofounder either.

What's left is four incidents between March 2025 and early 2026. Two of them broke in exactly the same place, less than a year apart. In all four, the fix was known before launch and nobody applied it. We'll take them in order, with the lesson from each, and finish with four tests you can run on your own product this week.

Enrichlead (March 2025)

The product. A sales lead SaaS. Its founder posted on X that it was built with Cursor, with "zero hand written code", and that people were paying for it.

What broke. Two days after that post, he wrote that he was under attack. People were bypassing the subscription and maxing out his API keys, and junk records were showing up in the database. He tried to fix it with the same tool, and according to Kaspersky's write-up, the project was shut down after he couldn't get the security problems under control.

The lesson. The paywall has to be enforced on the server. A greyed-out button in the browser is a suggestion, and the API behind it is what users actually talk to.

The Lovable apps (disclosed May 2025)

What happened. Matt Palmer, a security researcher, scanned 1,645 public apps built with Lovable and found 170 of them, about one in ten, with database endpoints that anyone could query. The exposed data included user tables and API keys. The finding was published as CVE-2025-48757, and this write-up has the numbers.

Why. These apps talk to Supabase straight from the browser. That design is safe only if row-level security policies decide who can read which rows. In the affected apps, the policies were missing or didn't match the business logic.

The lesson. On a browser-to-database stack, the RLS policies are your backend. If nobody wrote the policies, nobody wrote the backend.

SaaStr and the Replit agent (July 2025)

What happened. Jason Lemkin, the founder of SaaStr, was partway through a public experiment building an app with Replit's AI agent, and he had declared a code freeze. The agent deleted the production database anyway, with records on more than 1,200 executives and over 1,190 companies. Then it told him a rollback wasn't possible. It was, and the rollback worked (The Register, Fortune).

What changed. Replit's CEO announced automatic separation of development and production databases, and a planning-only mode where the agent can't touch the live code.

The lesson. A code freeze written in a chat window is a request, not a control. The agent should hold only development credentials, and production should need a person. Backups count only once you've tested a restore.

Moltbook (January 2026)

The product. A social network for AI agents, launched at the end of January 2026. Its founder said he didn't write a single line of code for it.

What broke. Wiz researchers found a Supabase key in the site's client-side JavaScript. Supabase expects that kind of key to be visible in the browser and relies on row-level security to limit what it can do. Here row-level security was missing, so the key gave anyone full read and write access to the production database: 1.5 million API tokens and more than 35,000 email addresses.

What happened next. Wiz reported it and the team secured the tables within hours. Moltbook survived, and Meta acquired it in March 2026.

The lesson. The same one as the Lovable apps, less than a year later and at a much bigger scale. Moltbook was lucky about who found it first.

The shared pattern

None of the fixes was exotic. Each one was a check that nobody asked the AI to write. The code worked in the demo, and nobody whose job was to ask "what happens if someone misuses this?" looked at it before real users did.

Four tests to run this week

1. Log in as a free user and call a paid endpoint directly. It should refuse.
2. Find the database key in your site's JavaScript bundle and query your main tables with it while logged out. You should get nothing back.
3. List every credential your AI coding agent can use. None of them should reach production.
4. Restore last night's backup to a scratch database, and time how long it takes.

Related reading

• Seven defects we check first in any vibe-coded app: the wider checklist behind these four incidents
• We inherited an AI-generated codebase. Here is what we found: the same failures from inside a real codebase, and how we fixed them
• Burning tokens is not shipping: why more AI output isn't the same as more product

Built with a specific tool? Lovable, Replit Agent, Cursor. The service: Vibe Code Rescue.