Incident feed · ShipSecurely
4 incidents tagged AI-generated code, newest first.
On June 24, 2026, Google Cloud bulletin GCP-2026-043 said Firebase Studio's GetSignedGcsUrl call let an authenticated user list other tenants' buckets and download their deployment source code. The fix was already deployed. CVE-2026-12715, published July 17, 2026, says the bug was patched on April 15, 2026, rates it High with CVSS 4.0 score 8.5, and says no customer action is needed.
On April 22, 2026, Lovable published its account of an access regression. Between February 3 and April 20, 2026, public project chat history and source code could potentially be accessed by any Lovable user who had the project link. The post says private projects and Lovable Cloud were never impacted, and that the regression was fixed on April 20.
On July 29, 2025, Wiz Research published its report on Base44, the vibe-coding platform Wix had acquired. A non-secret app id was enough to create a verified account on a private app, including one that required single sign-on. Wiz says it reported the issue on July 9, 2025, and that Wix deployed a fix within 24 hours.
On May 30, 2025, CVE-2025-48757 was published for Lovable. It says an insufficient row level security policy through April 15, 2025 let remote unauthenticated attackers read or write arbitrary database tables on generated sites. The record rates that Critical, CVSS 3.1 score 9.3, and notes that the supplier disputes it.
23 tools · 109 fixes · 30 issue guides · Updated Oct 16, 2026 · Sources: Supabase, GitHub, OWASP, Vercel + 30
