Security news for vibe-coded apps

What happened: Nothing new, and that's the point. Exposed .env files, uploaded .git folders and secret keys inside front-end code are still among the most common ways small apps leak data.

Does it affect me? If you upload your whole project folder to a server, or your app's code contains secret keys.

What to do: Deploy only your build output, keep secret keys on the server, and change any key that was ever public. If you use Supabase, turn on Row Level Security for every table.

Sources:

• https://nvd.nist.gov/vuln/detail/CVE-2025-48757

• https://supabase.com/docs/guides/database/postgres/row-level-security

What happened: Next.js released urgent fixes for two critical bugs that could let an attacker run code on your server, plus a bug that could take your app offline.

Does it affect me? Most Next.js apps on older versions, especially self-hosted ones (Docker or a VPS).

What to do: Upgrade to next@16.4.1 (or next@15.5.28) and redeploy. Ask your AI builder to "upgrade Next.js to the latest patch version."

Sources:

• https://nextjs.org/blog/nextjs-security-update-october-14-2026

• https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw

What happened: NGINX released versions 1.30.6 and 1.31.7 to fix five medium-risk security bugs.

Does it affect me? Only if you run your own server with NGINX. Apps on Vercel, Netlify or Lovable hosting don't manage NGINX themselves.

What to do: Update NGINX, and hide its version number from visitors.

Sources:

• https://nginx.org/en/security_advisories.html

What happened: A serious flaw in the Bricksforge plugin lets outsiders take over a WordPress site. Attacks started in early October 2026.

Does it affect me? If your WordPress site uses Bricksforge 3.1.8.9 or older.

What to do: Update Bricksforge to 3.1.8.10 or newer today. If you can't, turn the plugin off until you can.

Sources:

• https://nvd.nist.gov/vuln/detail/CVE-2026-85097

• https://bricksforge.io/version-changelog/

What happened: In early October, attackers published bad versions of two npm packages, tensorlake and @subql/common. Installing them could steal tokens and keys from your computer or CI.

Does it affect me? Only if your project installed tensorlake@0.5.144 or @subql/common@5.8.3. Check your lockfile.

What to do: Move to a safe version, follow the cleanup steps in the official advisory, then change any keys and tokens that were on that machine. In general, review new dependencies your AI tool adds.

Sources:

• https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2

• https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm

• https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/

What happened: Next.js shipped fixes for several security bugs, including ways to leak data from caches and the development server.

Does it affect me? If your app runs on Next.js and you haven't upgraded since September, probably yes.

What to do: Upgrade to the latest Next.js version (16.4.1 or 15.5.28 or newer, which also include the October fixes). Never leave next dev running on a public server.

Sources:

• https://nextjs.org/blog/september-2026-security-release

• https://nvd.nist.gov/vuln/detail/CVE-2026-94483