Scan of 978 vibe-coded apps finds 1 in 26 leaks a secret API key

A developer scanned 978 public apps built with Lovable, Bolt and v0 and found that 37 of them (1 in 26) ship at least one secret key to every visitor. Exposures included 17 Telegram bot tokens, 9 AI keys (Groq, Gemini, OpenAI, OpenRouter) and 6 critical keys such as GitHub tokens; 8.8% of sites served public source maps.

• 37 of 978 apps (1 in 26) expose at least one secret key to every visitor
• 17 leaks were Telegram bot tokens, 9 were Groq, Gemini, OpenAI and OpenRouter keys
• 8.8% of sites served public source maps revealing original source code
• Cause: VITE_, NEXT_PUBLIC_ and REACT_APP_ variables baked into client bundles