Moltbook — vibe-coded social network exposes 1.5M API tokens and 35K emails
Date: 2026-02
Affected: Moltbook — 1.5M API tokens, 35K emails, private messages
Attack vector: other
Category: real-world
Severity: Critical

Moltbook, a social network built entirely via vibe coding (zero manual code), exposed 1.5 million API authentication tokens, 35,000 email addresses, and thousands of private messages via an unsecured Supabase database. The AI scaffolded the database with permissive settings; the founder deployed as-is without review.

Impact: First major real-world vibe-coding security disaster; mass data exposure; trust damage

Mitigations:
Automated security scanning of AI-scaffolded applications
Database access control defaults
Security review of AI-generated infrastructure code before deployment

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: AI-generated code with insecure default database configuration
role: origin
label: Deployment & Infrastructure
notes: Unsecured database exposed to public internet
role: impact