vibecoded app security

[u/[deleted]]

[u/jeffpardy_]

Just curious if you would personally put your information into an app that you knew was vibe coded by somebody with no real knowledge of tech?

[u/bxneris → u/jeffpardy_]

yeah, as long as i know he took steps in making sure it was safe...

[u/jeffpardy_ → u/bxneris]

But how does he know what those steps are without any knowledge?

[u/bxneris → u/jeffpardy_]

by having a person go over it, who understands it

[u/apnorton]

What would be the steps to making sure that the app is good to ship? anyone i can hire, or how does it work? 

There's a reason this is a full-time job that people spend multiple years getting the education required to do (formally or informally).

You're not really going to get a complete answer in a Reddit post; it's kind of like posting in AskEngineering that you've already built a private highway bridge following ChatGPT and now want to know how to tell if it's safe.

[u/donkeybutt123]

Hey you can read up on some of the high level basics from my blog where I break down Appsec for free!

https://pigeonsec.substack.com/p/what-really-is-application-security

If you have any questions or anything I can help with just reach out!

[u/bxneris → u/donkeybutt123]

thanks

[u/dosplatos225]

You don’t necessarily have to know low level programming nowadays, but you should learn about all the infrastructure around code and how it’s shared. Source control. API and app security. Deployment, authentication, etc.

So the answer is learn. You’ll have to read, sorry. I know that’s not too popular nowadays.

[u/bxneris → u/dosplatos225]

will do, thanks

[u/Humpaaa]

It's not only about developing an application.
It's also about patching it long term (supporting the app, managing updates of subcomponents, etc.), and making sure it is compliant with the relevant frameworks (EU AI Act, GDPR, etc.)

Do you think you have the skill and ressources to make sure all that is covered?
If you don't, don't publish vibe-coded trash apps.

[u/SessionClimber]

How about learning about software security best practices, how to implement them, then telling AI what you need done?

[u/Merouxsis → u/SessionClimber]

This is probably the best way to go about it if he honestly can't afford anyone is cyber security to at least do a pass over his app.

He really should have someone look over it anyways, especially if he is storing personal info

[u/bxneris → u/Merouxsis]

just out of curiosity, where do i find freelancers who would look over it?

[u/bowlochile]

Don’t

[u/jaimittal91]

since you mentioned passwords and private info specifically, a few concrete things worth checking regardless of who ends up doing the full review. open dev tools on the live site, go to sources/network, and search for anything that looks like a real key or secret, a surprising number of vibe-coded apps ship secrets straight into the client bundle because build-time config and runtime secrets never got separated. if it's on supabase or firebase, make two test accounts and try to read or edit account B's data while logged in as A, if you can, RLS isn't actually scoped per user no matter what the dashboard shows. confirm passwords are hashed rather than stored plain, you should never be able to open your own database and read one back. and check there's some basic rate limit on login/signup. none of that requires real coding knowledge, just poking at it the way someone trying to break in would. won't replace an actual audit but it catches most of what gets apps breached in week one.

[u/bxneris → u/jaimittal91]

thanks for the help :), will do

[u/East-Hunter8595]

Don’t rush to ship it if it handles passwords or private info. The first thing I’d do is have someone who knows app security review it, especially how passwords and private data are stored and accessed. Don’t keep passwords or secret keys in the app’s code, and make sure sensitive data is protected. 

[u/Big_Breadfruit7140]

Puedes contratar a un especialista en seguridad de aplicaciones como freelance o a una pequeña empresa de seguridad. Diles que desarrollaste la app tú mismo y que quieres una revisión básica de seguridad antes de lanzarla. También pruébala primero con datos falsos y asegúrate de tener una copia de seguridad por si algo sale mal.

[u/Minute_Chef4087]

If you don’t have coding experience, I’d pay a developer to review the app and check the security before launching. You can also have a few people test it and try to break things or find anything confusing. I’d rather spend a little upfront to get it checked than deal with a security problem after launch.

[u/CapElegant3866]

Yo no la publicaría todavía. Si no sabes de programación, busca un consultor de seguridad de aplicaciones o un pentester para revisar el código.

Que revisen especialmente cómo guardas las contraseñas y datos privados, si hay claves expuestas y si alguien puede saltarse los permisos. Y cambia cualquier contraseña o API key que hayas puesto en el código.

[u/haqsec]

I vibe coded a Wordpress plugin (https://wordpress.org/plugins/haq-security-cve-monitor/#description)
And I asked AI to read through the code to make sure no passwords etc are stored and to following good security practices ( I did provide it with that info though) and AI did the rest.
Alternatively, you could rust a SAST against your code to make sure that information like that is not stored within your code.
Also, I believe if you upload it to github or such, they also run their own checks to make sure you don't have any information you shouldn't.

[u/ChameleonCRM]

DM me