The Vibe Coding Problem
Everyone's shipping faster than ever. Cursor, Copilot, Claude, ChatGPT — developers are generating entire apps in hours instead of weeks. The productivity gains are real. The security gaps are worse.
I've spent the last month scanning AI-generated mobile apps that made it to the Play Store and App Store. Not prototypes. Not side projects. Production apps processing real user data, handling payments, storing health records. The results are ugly.
This isn't an anti-AI take. I use AI tools every day. But there's a dangerous assumption baked into vibe coding: if the code compiles and the tests pass, it's ready to ship. That assumption is getting people breached.
What We Found
We ran 47 AI-generated apps through appaudix — a mix of fintech, healthtech, and e-commerce apps where developers publicly credited AI tools in their changelogs or social media posts. Here's the breakdown.
Hardcoded Secrets: 83% of Apps
The single most common issue. AI assistants love to generate complete, working code — and that means filling in every parameter, including API keys, database credentials, and signing configurations.
// AI-generated code that shipped to production
val STRIPE_SECRET_KEY = "sk_live_51N8x..."
val FIREBASE_API_KEY = "AIzaSyC..."
val MAPS_API_KEY = "AIzaSyB..."
The AI generated working code. The developer tested it. It worked. They shipped it. Nobody asked "should these be in the binary?"
This isn't hypothetical. We extracted live Stripe secret keys from 3 different APKs. One had a Firebase service account key with full database admin access. Anyone with a decompiler — or even just strings — could pull these out in seconds.
PCI DSS 4.0.1 Requirement 6.2.2 explicitly requires that applications do not contain hardcoded credentials. Every one of these apps would fail a compliance audit on day one.
No Certificate Pinning: 91% of Apps
This was the worst category. Out of 47 apps, only 4 implemented any form of certificate pinning. AI code generators consistently produce networking code that trusts the system certificate store by default:
// What AI generates
let session = URLSession(configuration: .default)
// What a payment app needs
let session = URLSession(
configuration: .default,
delegate: PinningDelegate(
pinnedHashes: ["BBBBBBB...", "CCCCCCC..."]
),
delegateQueue: nil
)
Without certificate pinning, any attacker on the same network can intercept API traffic with a proxy like mitmproxy. For payment apps, this means card numbers, tokens, and session credentials are exposed to trivial MITM attacks.
OWASP MASVS NETWORK-1 requires certificate pinning for sensitive connections. PCI DSS 4.0.1 Requirement 4.2.1 mandates strong cryptography for cardholder data in transit.
Plaintext Local Storage: 74% of Apps
AI models default to the simplest storage mechanism available. On Android, that's SharedPreferences. On iOS, that's UserDefaults. Neither is encrypted.
// AI-generated: stores auth token in plaintext
val prefs = getSharedPreferences("app_prefs", MODE_PRIVATE)
prefs.edit().putString("auth_token", token).apply()
prefs.edit().putString("user_email", email).apply()
On a rooted device — or via a backup extraction — all of this data is readable in plain text. We found apps storing:
- Session tokens and refresh tokens
- User email addresses and phone numbers
- Payment card last-four digits
- Health data (in a HIPAA-regulated app)
The secure alternatives exist and aren't hard to use. Android has EncryptedSharedPreferences. iOS has Keychain. But AI doesn't reach for them unless you explicitly ask.
Zero Obfuscation: 68% of Apps
More than two-thirds of the Android apps we scanned shipped without ProGuard or R8 obfuscation enabled. The AI generates the application code but doesn't touch the build configuration. Developers who aren't Android-native often don't even know obfuscation is a thing.
The result: you can decompile the APK with jadx and read the source code almost verbatim. Class names, method names, string constants, API endpoints — all perfectly readable. Combined with hardcoded secrets, this turns every APK into a complete API documentation package for attackers.
Missing Root/Jailbreak Detection: 96% of Apps
Almost none of the AI-generated apps checked for rooted or jailbroken devices. This is table stakes for any app handling sensitive data. A rooted device can:
- Read any app's private storage
- Hook any function at runtime with Frida
- Bypass biometric authentication
- Intercept all network traffic without a proxy
AI doesn't think about the threat model. It solves the functional requirement ("build me a login screen") without considering the adversarial environment the app runs in.
Why AI Gets Security Wrong
This isn't a model quality issue. It's a training data and incentive problem.
1. Training data skews toward tutorials, not production code. Stack Overflow answers and GitHub repos optimize for clarity and simplicity. Security hardening is treated as an advanced topic, not a default.
2. Security is a negative requirement. AI excels at building features — things the app should do. Security is about what the app should not do, or what it should resist. That's fundamentally harder to express in a prompt.
3. No adversarial testing in the feedback loop. The developer tests "does the login work?" and "does the payment go through?" Nobody tests "can I extract the API key from the binary?" or "what happens if I MITM the connection?"
4. Context window limitations. Security requires holistic thinking — how does this storage choice affect the whole app? What happens if this device is compromised? AI processes code in chunks and doesn't maintain a threat model across the full codebase.
The Compliance Gap
Here's where it gets expensive. AI-generated apps aren't just insecure — they're non-compliant. And non-compliance has teeth.
| Framework | Common AI-Generated Violations | Penalty Range | |-----------|-------------------------------|---------------| | PCI DSS 4.0.1 | Hardcoded credentials, no pinning, plaintext storage | $5,000-$100,000/month | | HIPAA | Unencrypted PHI, no access controls | Up to $1.9M per violation | | GDPR | Insufficient data protection, no encryption at rest | Up to 4% global revenue | | OWASP MASVS | Fails STORAGE, NETWORK, CRYPTO, RESILIENCE categories | Varies by industry |
A fintech startup that vibe-coded their payment app and skipped security scanning could face PCI fines that exceed their entire runway. A health app storing patient data in UserDefaults is a HIPAA violation waiting to become a lawsuit.
What To Do About It
I'm not saying stop using AI tools. I'm saying stop trusting AI output without verification.
1. Scan Before You Ship
Run every build through automated security scanning. This catches the mechanical issues — hardcoded secrets, missing pinning, plaintext storage, obfuscation gaps — before they reach production. This is exactly what appaudix does: upload your APK or IPA and get a compliance report in minutes.
2. Add Security to Your Prompts
If you're using AI to generate code, include security requirements in the prompt:
"Generate a login screen for Android that stores the auth token in EncryptedSharedPreferences, implements certificate pinning for all API calls, and includes root detection checks."
The AI can produce secure code — it just doesn't do it by default.
3. Treat AI Output Like a Junior Developer's PR
Review it. Question it. Check the build config. Look for hardcoded strings. Verify that networking uses pinning. Ensure storage is encrypted. The AI is fast but it's not security-aware.
4. Automate in CI/CD
Don't rely on manual reviews. Integrate security scanning into your pipeline so every build gets checked. If the scan fails compliance, the build fails. No exceptions.
The Bottom Line
AI-generated code ships fast and breaks compliance faster. The gap between "it works" and "it's secure" has never been wider, because the tools that accelerate development don't accelerate security. Every AI-generated app needs the same security scrutiny as hand-written code — arguably more, because developers tend to trust AI output in ways they wouldn't trust their own first draft.
The apps we scanned aren't outliers. They're the norm. If you've used AI to build a mobile app that handles user data, payment information, or health records, you need to verify it before your auditor — or an attacker — does it for you.
Ship fast, scan faster. Run a free security scan on your app now.