--- title: What is AI AppGen Security? | daily.dev description: AI AppGen security covers the practice of discovering and governing applications generated by AI app builders (Replit, Lovable, Vercel, Supabase, etc.) that... canonical: https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What is AI AppGen Security? | daily.dev og:description: AI AppGen security covers the practice of discovering and governing applications generated by AI app builders (Replit, Lovable, Vercel, Supabase, etc.) that... og:url: https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq og:image: https://api.daily.dev/og/posts/ulQBVZpoQ.png og:image:alt: What is AI AppGen Security? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is AI AppGen Security? **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 16 min read · 0 upvotes · 0 comments ## Summary AI AppGen security covers the practice of discovering and governing applications generated by AI app builders (Replit, Lovable, Vercel, Supabase, etc.) that are deployed outside traditional development pipelines. The core risk is the running application itself — its internet exposure, database access, credentials, and identity — not just the code quality. Platforms operate under a shared responsibility model where builders remain accountable for configuration choices they often don't understand. Research by RedAccess found over 5,000 vibe-coded apps with virtually no authentication, with ~40% exposing sensitive data. Key risks include wrong workspace publish defaults, Supabase RLS not applied to SQL-created tables, credentials stored insecurely, and no organizational inventory of these apps. Best practices include discovering apps via vendor hosting domains, enforcing database-level RLS, using organization workspaces to change publish defaults, and assigning named owners with review dates to every generated app. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Supabase enable row level security by default on all tables? Supabase enables RLS by default only on tables created through the Table Editor dashboard. Tables created via raw SQL or the SQL editor do not have RLS enabled automatically — the documentation explicitly warns developers to enable it manually. RLS must always be enabled on tables in an exposed schema, which is the public schema by default. _Teams building on Supabase track security gotchas like this one on daily.dev before they ship._ ### What is the default visibility of apps published from a personal Replit workspace? Apps published from a personal Replit workspace default to Public, meaning anyone on the internet with the URL can use the app. Apps in an organization workspace default to a private option. Changing the access setting requires unpublishing the app first, which takes it offline. The distinction between workspace types is the single configuration decision that determines exposure. _Developers governing vibe-coded apps across their org follow platform default changes like this on daily.dev._ ### Does Vercel protect production domains on the Hobby plan with deployment protection? On Vercel's Hobby plan, Standard Protection covers preview deployments and deployment URLs but leaves the production domain publicly accessible. Protecting the production domain requires a Pro or Enterprise plan. Private production deployments fall under Advanced Deployment Protection, which Enterprise includes and Pro customers can add for $150 per month. _Engineers choosing between Vercel plans for production security weigh trade-offs like these on daily.dev._ ## Similar posts on daily.dev - [Introducing AI AppGen Security to Protect the New Generation of AI Builders](https://daily.dev/posts/introducing-ai-appgen-security-to-protect-the-new-generation-of-ai-builders-p486ilgm2) · Orca Security Blog · 0 upvotes · 0 comments - [The Default SaaS Starter Pack Is the Least Secure Way to Ship an App](https://daily.dev/posts/the-default-saas-starter-pack-is-the-least-secure-way-to-ship-an-app-w6mw2xewx) · Medium · 0 upvotes · 0 comments - [AI-Generated Apps Without DevOps: A Security Disaster Waiting to Happen](https://daily.dev/posts/ai-generated-apps-without-devops-a-security-disaster-waiting-to-happen-ygwps6x1t) · DevOps.com · 0 upvotes · 0 comments - [I keep finding vibe coded apps that leak user data, and I'm not even looking for it](https://daily.dev/posts/i-keep-finding-vibe-coded-apps-that-leak-user-data-and-i-m-not-even-looking-for-it-74ydqzotl) · XDA Developers · 4 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#appsec](https://daily.dev/tags/appsec), [#vibe-coding](https://daily.dev/tags/vibe-coding) [View this post on daily.dev](https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What is AI AppGen Security?","url":"https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq"},"datePublished":"2026-08-07T12:53:35.770Z","dateModified":"2026-08-07T12:54:12.527Z","description":"AI AppGen security covers the practice of discovering and governing applications generated by AI app builders (Replit, Lovable, Vercel, Supabase, etc.) that...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/284a0a7ae37829f014e18aca5698f94d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/284a0a7ae37829f014e18aca5698f94d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,appsec,vibe-coding","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"What is AI AppGen Security?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-is-ai-appgen-security--ulqbvzpoq#faq","mainEntity":[{"@type":"Question","name":"Does Supabase enable row level security by default on all tables?","acceptedAnswer":{"@type":"Answer","text":"Supabase enables RLS by default only on tables created through the Table Editor dashboard. Tables created via raw SQL or the SQL editor do not have RLS enabled automatically — the documentation explicitly warns developers to enable it manually. RLS must always be enabled on tables in an exposed schema, which is the public schema by default. Teams building on Supabase track security gotchas like this one on daily.dev before they ship."}},{"@type":"Question","name":"What is the default visibility of apps published from a personal Replit workspace?","acceptedAnswer":{"@type":"Answer","text":"Apps published from a personal Replit workspace default to Public, meaning anyone on the internet with the URL can use the app. Apps in an organization workspace default to a private option. Changing the access setting requires unpublishing the app first, which takes it offline. The distinction between workspace types is the single configuration decision that determines exposure. Developers governing vibe-coded apps across their org follow platform default changes like this on daily.dev."}},{"@type":"Question","name":"Does Vercel protect production domains on the Hobby plan with deployment protection?","acceptedAnswer":{"@type":"Answer","text":"On Vercel's Hobby plan, Standard Protection covers preview deployments and deployment URLs but leaves the production domain publicly accessible. Protecting the production domain requires a Pro or Enterprise plan. Private production deployments fall under Advanced Deployment Protection, which Enterprise includes and Pro customers can add for $150 per month. Engineers choosing between Vercel plans for production security weigh trade-offs like these on daily.dev."}}]} ```