Vibe Coding Is Straining APIs, and Platforms Are Pushing Back

The bill for easy software has arrived at the API layer

For most of the past two years, the debate over vibe coding has focused on the person typing the prompt. Can a non-programmer really ship an app? Is the code any good? Will developers lose their jobs? Recent coverage points somewhere else. Much of the pressure now lands on the APIs these apps call, the credentials that unlock them, and the platforms that have to absorb a sudden rush of AI-generated clients. In October 2026 that pressure showed up in app stores, enterprise IT departments and developer programs alike. The industry is responding by building gates around its APIs.

The Atlantic described app stores swamped by look-alike submissions. One example is the many clones of the nutrition tracker Cal AI, some of which use nearly the same names and icons.11 MIT economist Mert Demirer told the magazine that whatever is causing it, almost nobody is using these apps. Downloads fell this year while time spent in apps stayed roughly flat.11 The same report links the flood to infrastructure: it cites a Strava community manager who blamed "zero-code AI tools that produce apps that hammer APIs."11

Strava as the test case

The Strava case is the clearest sign of where things are going. In a June 1 developer update, the fitness platform said applications to its developer program were up 448% year-to-date. It said API intermediaries had broken its terms and scraping had slowed the platform for all users.31 It accused AI companies of three things: scraping for training data, abusing APIs through intermediary layers, and offering zero-code tools whose output overwhelms its endpoints.31

Strava's answer was to rebuild its developer program. New apps now start serving only the developer. They can self-upgrade to 10 athletes without review, but growing beyond that requires Strava's approval. An Extended Access tier for apps above 10,000 users comes with higher rate limits and access to partner APIs.3339 The new API Policy goes much further than limits on traffic. It bans using Strava data in any AI application, including retrieval-augmented generation and placing data in a model's context window. The only exception is Strava's own MCP connector.3336 The policy also bans sending Strava data through no-code AI platforms, proxies and aggregators, and running a third-party MCP server over that data.33

Reports on the cost of access don't fully agree. The Verge and other outlets, following TechCrunch, described a flat $11.99 monthly fee for developers.3438 A developer-focused breakdown points out that Strava's FAQ says there is no separate API fee. Instead, a Strava subscription is a requirement for creating an app.33 In practice the result is the same: developers pay to build. But the wording matters. Strava presents API access as a perk of membership, not a product sold on its own.

There is a second disagreement, about how rate limits are counted. One wearables-integration guide says Strava's limits apply per athlete, which would make them generous for large apps.37 Strava's own getting-started documentation says limits apply per application, and another analysis says every connected athlete shares the same pool.3539 The per-application reading matches Strava's documentation and is the safer assumption. Under that reading, a small vibe-coded app that polls for updates every few minutes can use up its daily allowance quickly. That is the problem Strava says it is trying to stop.

One commentator captured the overall logic: Strava isn't against AI, it's against AI it doesn't get paid for.38 The same update that tightened third-party access also added a first-party path for users to send their pace, heart-rate and GPS data to Anthropic's Claude.3438 That reading seems right. Strava wants to own the AI interface to its data instead of letting thousands of prompt-generated clients query it for free.

The security side: keys in the browser

If one problem is too much traffic hitting APIs, the other is apps that leave the keys to those APIs exposed. The security reporting is unusually consistent. The most common serious flaws in vibe-coded apps are secrets shipped to the client and access controls that exist only in the front end.

One widely cited case is Moltbook, an AI social network built entirely with AI tools. It exposed about 1.5 million API authentication tokens and 35,000 email addresses.2229 Reports agree on the cause: a Supabase database without Row-Level Security configured.2224 They differ slightly on dates. OX Security places the breach in January 2026, while another account says Wiz found the exposure in February.2224

The broader scans point the same way. Escape.tech scanned 5,600 deployed vibe-coded apps and found more than 2,000 vulnerabilities and over 400 exposed secrets.2229 A January 2026 scan of more than 20,000 indie launch URLs found that about 11% exposed Supabase credentials in their front-end code.24 A Replit employee who looked at 1,645 apps built with Lovable reported 170 leaking personal data, financial information and API keys.29 Separately, Wiz researchers found that Base44 had exposed endpoints that let attackers bypass authentication on private apps using only an app ID visible in the URL.29

The percentages in vendor reports vary: around 45% of AI-generated code samples in one report, and 62% in another firm's framing.2224 The exact figure matters less than how consistent the failures are. Security firms explain them the same way. Hardcoding a key is the fastest way to get an integration working. Hiding an admin button in the interface looks like access control even though the API behind it stays open.2830 One practitioner described the attack plainly: sign up for a legitimate account, then call the REST API directly and skip the app entirely.21 The money involved is real. Exposed OpenAI and cloud keys have reportedly run up charges ranging from hundreds to thousands of dollars overnight.2329

The Atlantic's reporting supports the same concern from the user side. Red Access CEO Dor Zvi noted that once an app handles personal data, its creator becomes its entire security and support team, often without the skills for either job.11

Platforms are moving secrets out of the user's hands

The vendors' response this year follows a clear pattern: take credential handling away from the builder. In March, Google upgraded the vibe coding experience in AI Studio and highlighted secure storage for API keys users bring to connect databases, payment processors and Maps.5 Lovable's backend now supports storing third-party keys as secrets and calling them from edge functions so they never reach the browser.8 Emergent's guidance puts credentials in environment variables and warns against putting them in front-end files.8 The app builder Anything goes further. Its pitch is hundreds of preconfigured APIs and built-in access to frontier models with "no API keys" for the user to manage.4 That claim comes from the company's own press release, but it shows where competition in the category is heading.

Companies are taking a similar approach. On October 15, Cloudflare open-sourced Void, a self-hosted platform where companies can deploy and manage apps built by employees, with admin controls over who can publish and who can access each app.13 A Cloudflare strategy lead said the company's internal instance is open only to employees, which by default prevents data leaks through vibe-coded apps.13 The New Stack noted the limits. Restricting access doesn't stop an app from pulling sensitive data and sending it elsewhere. Apps can be made public, and Void has no mandatory security review before deployment.13

Google is also creating private spaces for these apps. Since October 13, Google Play lets U.S. adults run personal apps vibe-coded in AI Studio without publishing them to the store.15 That eases pressure on store listings, though it also means more private clients running against whatever APIs they call.

Demand is not slowing

None of this is shrinking the market. Lovable is tracking toward $600 million in annual recurring revenue. It was valued at $13.3 billion in August, and its integrations with Google Workspace, Microsoft 365, Salesforce and Stripe connect generated apps directly to enterprise systems.12 On October 29, the UAE launched a national vibe coding initiative with Microsoft that drew 5,000 participants in its first hour.17 Epic Games confirmed it is using Claude Code and Codex in work on Unreal Engine 6 and Fortnite. Its development chief said engineers are steering the tools instead of writing most of the code themselves.1419

The takeaway

The overall picture is clear even though the details vary. Vibe coding has made the cost of creating an API client close to zero. The cost of serving, securing and policing that client stays with the platform. Strava's paywall and AI ban, Google's and Lovable's managed secrets, and Cloudflare's governed deployment platform are responses to the same imbalance. The likely result is that public APIs become more tiered, more expensive to access, and more often limited to first-party AI connectors, while the remaining open access depends on platforms that keep the keys away from the people prompting the apps.