Replit shipped black-box pen testing and Masad said static scanning isn't enough.

Replit added security scans that probe deployed apps the way external attackers would, rather than reading source. Masad's framing: "it's not enough to scan your code for vulnerabilities," you have to try to break them. That's a notable admission of the vibe-coding security gap from the CEO of the platform most associated with non-engineers shipping production apps. Read it next to the Wiz story, where source scanning also missed the actual bug.