Developer catalogs four recurring security holes AI coding agents ship in Next.js + Supabase apps

On November 10, 2026, a developer who regularly uses Claude Code, Cursor, and OpenCode posted on DEV Community about four categories of security vulnerabilities that AI coding agents repeatedly produce in Next.js + Supabase projects. The author's point is that the bugs these agents write are not the kind a tired human makes. A person might forget to escape some input; an agent, by contrast, writes a perfectly structured endpoint that has no authentication at all, then reports the task as done and moves on to the next one. The post walks through the four patterns the author kept running into in Next.js + Supabase projects and explains how each pattern was turned into detection rules for vibe-shield, an open-source scanner. Based on the material available, the record ends at the publication of this summary post; no further developments are documented.