Findings by severity
All 283 findings, by triage level.
High+ 77
Medium 178
Low 28
SECURITY RESEARCH
The auth bugs AI coding tools ship by default.
AI coding tools repeat the same authentication anti-patterns across the projects they touch. We scanned 132 public repositories that describe themselves as AI-generated applications and measured which auth anti-patterns turn up, how often, and how severe they are. Here is what we found, reported in aggregate, with no repository, author, or specific tool named.
Updated June 27, 2026 · OAuthLint v0.4.0 · default ruleset
132
repositories scanned
27%
had ≥1 auth finding
18%
had a HIGH+ finding
283
total findings
~57%
of all findings landed on the exact patterns we tag as HIGH-prevalence in AI-generated code, the bugs OAuthLint was built to catch. The rules and the corpus point the same way: these are the anti-patterns AI tools reach for first.
MOST COMMON PATTERNS
The anti-patterns that showed up most across the corpus. Each one links to its rule page, where you can read what it is, why it matters, and how to fix it.
| Pattern | CWE | Findings | % of repos |
|---|---|---|---|
| Non-constant-time secret comparison | CWE-208 ↗ | 75 | 13% |
| Auth tokens in browser storage | CWE-922 ↗ | 60 | 8% |
| Session identifier in the URL | CWE-598 ↗ | 27 | 8% |
| Hard-coded provider / API keys | CWE-798 ↗ | 27 | 5% |
| No rate limiting on auth endpoints | CWE-307 ↗ | 23 | 4% |
| Secrets written to logs | CWE-532 ↗ | 8 | 2% |
Counts are findings (static matches); "% of repos" is the share of the 132 scanned repositories with at least one such finding. A repository can appear under several patterns.
DISTRIBUTIONS
Findings by category
Which area of the auth surface they land in.
flow 115
jwt 76
secret 28
session 27
oauth 16
tls 6
Affected repositories by language
Primary language of the repositories that carried at least one finding.
TypeScript 98
JavaScript 14
HTML 9
Python 8
METHODOLOGY
We assembled a corpus of 132 public repositories that describe themselves as AI-generated or "vibe-coded" applications. We found them through GitHub search over that category, not by targeting any one tool. Each repository was scanned with OAuthLint v0.4.0 using the default ruleset. A "finding" is a static match of an auth anti-pattern: 283 findings across 35 affected repositories, an average of 8.1 per affected repository.
The measurement is reproducible. The ruleset is open and the scan is one command. Run it against any codebase:
$ npx oauthlint scan ./src
$ semgrep --config https://oauthlint.dev/r/oauthlint.yaml ./src
LIMITATIONS
- Self-identification ≠ line-level authorship. A repository describing itself as AI-generated does not prove every line was written by an AI tool. We measure code that ships under that banner, not provenance per line.
- Auth surface concentrates the rate. Many repositories in the corpus are frontend-only or demos with no real auth code, so they cannot produce auth findings. The finding rate is therefore concentrated in the subset of repositories that actually handle authentication.
- Findings are static, not confirmed exploits. Each finding is a low-false-positive static match, a potential issue worth review rather than a demonstrated vulnerability. We did not attempt exploitation.
- A snapshot, not a trend. These figures describe the corpus as scanned on June 27, 2026. The corpus and the AI tools that produce such code both move quickly; treat this as a point-in-time reading.
IN CONTEXT
Our reading lines up with independent research into AI-generated code from other teams.
Scan your own AI-generated code.
The same scan that produced these numbers runs against your repository in one command. No signup, MIT-licensed, low false positives.
$ npx oauthlint scan ./src
$ semgrep --config https://oauthlint.dev/r/oauthlint.yaml ./src