I Built a Security Scanner for AI-Generated Code — Then Found Vulnerabilities in My Own Projects What happens when you run your own tool on your own code

Been building with Cursor and Bolt lately like a lot of people here.

Started wondering — is the code these tools generate actually secure?
So I dug into it.

Turns out the numbers are bad:


45% of AI-generated code has OWASP Top 10 vulnerabilities (Veracode)
65% of vibe-coded apps have security issues (Escape.tech, 1400+ apps)
35 CVEs in a single month attributed to AI-generated code (March 2026)


Patterns I kept seeing in AI-generated code:


Hardcoded API keys and Supabase service keys
RLS