The Vibe Coding Security Risks That Turn Into Six-Figure Lawsuits

The vibe coding security risks nobody prices into the roadmap

Tools like Lovable, Bolt, Replit Agent, and Claude Code let a single founder ship a working app in a weekend. The security research on what that code actually contains is grim: Veracode's testing of over 100 large language models across 80 coding tasks found that 45% of AI-generated code samples failed basic security checks, and researchers at Georgia Tech's Systems Software & Security Lab logged just six CVEs attributable to AI-generated code in January 2026, then 35 in March alone.

That is the technical story, and it gets most of the attention. The legal story is worse, and it barely gets discussed, because it does not require an attacker. US law is stacked with statutes that price violations per instance rather than as a percentage of revenue: per visitor, per email, per text, per uploaded image. A sign-up form with no age question, a font pulled from Google's servers, an analytics script with session replay switched on, an email with no unsubscribe link. None of these need a hacker. They need a user, and most vibe-coded apps ship with several of them by default.

The privacy tripwires built into the default template

Three of the most common vibe-coded defaults are privacy violations before a single user does anything unusual. The first is the sign-up form with no age question. Under COPPA, the FTC can pursue civil penalties up to $53,088 per violation for collecting personal information from a child under 13 without verifiable parental consent, and each affected child can count as a separate violation.

The second is the font. Most templates pull Google Fonts directly from Google's servers, which sends every visitor's IP address to Google without consent. A Munich regional court ruled in 2022 that this violates the GDPR, awarding a visitor 100 euros in damages and warning the site owner that repeat violations would cost up to 250,000 euros. The fix, self-hosting the font files instead of linking to Google's CDN, takes a few minutes and removes the issue entirely.

The third is session replay analytics, the kind that records every click, scroll, and keystroke to help a founder understand user behavior. Under California's Invasion of Privacy Act, courts have accepted the theory that this constitutes wiretapping, with statutory damages of $5,000 per violation and no requirement to prove actual harm. The Los Angeles Times settled a CIPA claim over ad trackers for $3.85 million in June 2026, covering three years of website visitors.

Where CAN-SPAM compliance and TCPA lawsuits actually bite

A launch email to a waitlist with no unsubscribe link and no physical address violates CAN-SPAM compliance requirements, and the FTC can assess up to $53,088 per non-compliant email, not per campaign. Send that email to a few thousand people and the theoretical exposure runs into the hundreds of millions, even though real settlements land far below the statutory maximum.

Texting the same waitlist is worse. Marketing texts sent without prior express written consent violate the TCPA, and the private right of action means any recipient can sue directly for $500 per text, rising to $1,500 for willful violations, with no cap on total liability. TCPA lawsuit filings rose nearly 95% year over year through mid-2025, and the math scales fast: 10,000 texts without consent is $5 million in statutory exposure at the base rate alone.

Subscriptions carry a separate trap. California's Automatic Renewal Law requires that renewal terms sit in visual proximity to the sign-up button and that a business obtain explicit affirmative consent before charging a renewal. Fail that disclosure requirement and Section 17603 of the law deems the goods an unconditional gift, meaning the business owes a full refund regardless of how many billing cycles already ran. Savage X Fenty paid $1 million in civil penalties over exactly this kind of disclosure failure.

Then there is the content users upload themselves, profile pictures, memes, anything users post that turns out to be someone else's copyrighted work. Registering a DMCA safe harbor agent with the US Copyright Office costs $6 and takes about ten minutes online. Skip it, and a platform loses the safe harbor that shields it from liability for what its users post, exposing it to statutory damages of up to $150,000 per infringed work.

The infrastructure bill that arrives before any lawsuit does

Legal exposure is only half the picture. Vibe-coded infrastructure fails in ways that generate real invoices, fast. In one widely documented case, a developer's static site on Netlify was hit with a traffic spike, likely a DDoS attack, that generated a $104,500 bill in four days; Netlify's CEO ultimately waived it after the story went viral, but the platform's own forum shows this is not a one-off complaint.

Supabase row level security left disabled is the single most common infrastructure mistake in AI-built apps. The public anon key is meant to be exposed in frontend code; the row level security policies are supposed to be what stops anyone holding that key from reading the entire database. CVE-2025-48757 documented this exact pattern across more than 170 live Lovable-built apps, and in February 2026 the AI-agent social platform Moltbook exposed roughly 1.5 million authentication tokens through a Supabase database left with public read and write access.

Serverless functions add a third failure mode: recursion. A function that writes to the same resource that triggers it can call itself thousands of times before anyone notices, and cloud billing does not pause to ask permission. Milkie Way's founder has described burning $72,000 testing Firebase and Cloud Run before a budget alert had any chance to fire.

The website accessibility lawsuit wave hiding behind ADA website compliance

A site that cannot be navigated by keyboard and ships images with no alt text is not a hypothetical accessibility gap, it is the exact fact pattern behind most ADA website compliance lawsuits. Plaintiffs filed 3,117 website accessibility lawsuits in US federal court in 2025, a 27% increase over 2024, and the combined federal-and-state total for the year topped 5,000. Nearly 70% of those suits target e-commerce and small retail sites, not large corporations, which means a solo founder's storefront is squarely in the target range.

The fix list, in the order it actually matters

• Add an age question to sign-up and route anyone under 13 to a parental consent flow before storing any personal information.
• Self-host font files instead of loading them from Google's servers, or route the request through a proxy that strips the visitor's IP.
• Turn off session replay and keystroke capture until visitors have affirmatively consented to it, not just accepted a generic cookie banner.
• Put a working unsubscribe link and a real physical address in every marketing email, and process opt-outs within ten business days.
• Never text a list without documented prior written consent, and honor STOP replies immediately.
• Display renewal price, frequency, and cancellation method in visual proximity to the subscribe button, and get explicit affirmative consent.
• Register a DMCA designated agent with the US Copyright Office for six dollars if the app accepts any user-uploaded content.
• Enable Row Level Security on every Supabase table before shipping, and never expose the service_role key to the frontend.
• Put the app behind Cloudflare or a similar CDN with DDoS protection, and set a hard spending cap on the hosting account.
• Run a basic accessibility pass: alt text on every image, full keyboard navigation, and visible focus states.

Sources