What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks

This article examines Shadow Builders—employees building and deploying AI-powered applications to production systems without security oversight—revealing critical gaps in modern security practices.

• •Red Access discovered over 2,000 publicly exposed applications containing sensitive data, deployed without basic access controls
• •Traditional security tools (EDR, DLP, CASB, Firewall, SSE) operate in separate layers and fail to detect vibe-coded applications built within browser sessions
• •Vibe-coded applications connect directly to production systems through OAuth, API keys, or manual uploads, often published on the open internet
• •Session-layer visibility is essential to govern this new category, as the entire build-to-publish workflow occurs within the browser
• •