Studies, benchmarks and findings from the Rafter team
As of October 1, 2026. Truffle Security found 543,699 still-working credentials in 224 million public GitHub repositories. Push protection cut how often recognized secrets leak, but what kept the leaked ones alive was whether anyone revoked them. For credentials you mint yourself, nobody will unless you do.
Rafter's recurring audit of the security posture of major vibe-coding platforms — Lovable, Replit, Base44, Netlify, and Bolt. Volume 1 establishes the methodology, the May 2026 RedAccess baseline of 5,000 unsecured apps and 2,000 actively leaking data, a per-platform default audit (hosting indexability, authentication scaffolding, deploy-time privacy, published security guidance), and the platforms' response since the May 7, 2026 Wired disclosure. Quarterly cadence; Q3 2026 follow-up tracks default changes.