What is a zero-day vulnerability?
A zero-day vulnerability is a security hole that attackers know about before the maker of the software has released a fix, so there have been "zero days" to prepare. Until a patch arrives, anyone using that software can be attacked.
Also called: Zero-day, 0-day
ON THIS PAGE
What it means
Most problems get a patch soon after they're found. A zero-day is the dangerous window before that, when the weakness is being used but no fix is available yet.
You can't prevent a zero-day, but you can shrink the damage. Keep software up to date so you get the fix quickly, limit what each part can access, and watch for unusual activity.
Why it matters for vibe-coded apps
Apps built with AI tools sit on top of hundreds of packages. A zero-day in any of them becomes your problem, usually announced with very little warning.
- You can be exposed through a package you never chose directly.
- Attackers start exploiting a fresh hole within hours of it being public.
- Teams without an update routine take days or weeks to react.
Example
A new flaw is announced in a package you use.
# package.json pinned in 2024, never updated
# no alerts, no automatic update pull requests# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"Turn on Dependabot alerts too, so you hear about a flaw the day it's published.
How to check if your app has this problem
- 1Check whether your repo has Dependabot or a similar update tool switched on.
- 2Run npm audit and see how many known issues are open.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Turn on automatic dependency alerts and update pull requests.
- 2Apply security patches the same week they appear.
- 3Limit what each service and key can access, so one hole isn't a total breach.
- 4Keep a web application firewall in front of your site.
Set up automated dependency updates for my repo: add a Dependabot config for weekly npm updates with security updates grouped, enable alerts, and give me a short routine for applying urgent patches the same week.
Check if your app has this problem
Paste your website and we'll check for zero-day vulnerability issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Dependency vulnerabilityA known security hole in an add-on package your app uses.
- Web application firewall (WAF)A filter in front of your site that blocks known attack traffic before it reaches your app.
- Least privilegeGiving each person, key or app only the access it needs, and nothing more.
- Hallucinated packagesAdd-ons an AI suggests that don't exist, or that attackers have since created.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.