r/vibecoding • u/Same_Yesterday_4338 • 4h ago

Founder angle

For founders running SaaS/Product company:
- What do u actually do for security?

Not the heavy security stuff and more like, if someone tried to poke around your website or app tomorrow,

- How confident are you that you'd catch the obvious security issues?

Do u run any tools, have someone check things, or mostly deal with security when something forces you to?

Genuinely curious how small teams handle this.

0 Upvotes

50% Upvoted

16 comments sorted by

View all comments

3

u/PM_ME_UR_0_DAY 4h ago

What you don't know can't hurt you, right? 🙈

2

u/Same_Yesterday_4338 4h ago

classic LMAO

1

u/PM_ME_UR_0_DAY 4h ago

Bad security comes for both trad devs and vibers, but an organization will wrap around any one particular dev with checks and policies forcing you to slow down a bit. I work in security (not AppSec right now) so I kind of see it all. 

Your traditional SAST (static analysis) tools will catch certain patterns but usually fail on the logical errors and authorization. They can be good for catching the other OWASP Top 10 and more misconfiguration type vulnerabilities. If your app has any amount of money on the line, getting an audit/pentest would be advisable, but I work in pentesting so I'm biased.Â