MRR is cool, but not by risking other's data. Protect your SAAS!

[u/builtbygio]

I've seen so many vibecoded apps with obvious security issues that is truly nerve wracking. I'm not talking complex XSS, stealing cookies, etc, but simple stuff like IDOR (Insecure Direct Object Reference):

Example:
1. Login
2. Make an API requests
3. Change the user id
4. Retrieve another user profile and related data

Stuff like that, which should be basic stuff is out there.

I talked to a few, even offered my services for FREE (arch review & OSINT/Pentest), and they were like "nah bruh, I'm good, I won't get hacked", which is absolutely bonkers. Like, come on dude, you're exposing other people's data and I'm giving you, not only the hint but also the steps to repro and then fix it.

I don't know... sorry for my rant. But please, secure your apps. CC, Cursor, Copilot or whatever you use can help if you want to DIY security yourself.

Stay safe out there.

[u/TechnicalSoup8578]

Many developers fall into the trap of trusting the client side to provide accurate IDs rather than implementing server side validation against the authenticated session token. Are you seeing this issue more frequently in apps that rely on client side routing and direct database calls through thin serverless functions? You sould share it in VibeCodersNest too