ECHOES OF AI EXPOSURE: THOUSANDS OF SECRETS LEAKING THROUGH VIBE CODED SITES

Summary from the TLDR InfoSec newsletter

1 in 5 websites built on "vibe coding" platforms (no-code/low-code tools) expose sensitive secrets, with 25,000 leaked API keys found across 130,000 scanned sites, including a surge in AI platform credentials (72% Google Gemini, 14% OpenAI) and 16,000+ Firebase backend keys. The root cause is non-technical users following tutorials that embed API keys directly into client-side code without understanding the security implications, creating opportunities for credential theft and unauthorized service usage. Security teams should implement continuous threat exposure management (CTEM) to monitor citizen developer activities, while platforms need pre-publish secret scanning and better secret management features to prevent these exposures.