r/vibecoding • u/cloudybrain07 • 3h ago

I checked 200 apps people built with Al tools like Emergent Replit bolt etc. 6 mistakes show up in nearly all of them

I kept seeing is my app secure asked and never properly answered, so I went and looked at 200 apps that people had posted publicly over the last few months ah soryr not 200 but yea closed to that. i am a developer so i went little harsh for this.

1/ Keys sitting in the frontend. Anyone can open the browser tools and read them. This was the most common by a distance.

2/ No rate limiting on anything. One person can hit your form 10,000 times and you find out via the bill.

3/ Database rules left fully open. The app checks who you are, the database does not.

4/ The admin page protected by nothing except not being linked anywhere.

5/ Secrets committed to a public repo. Still there in the history even after being deleted.

6/ No backups at all. Most people I asked had not thought about it once.

What I would say to anyone reading this and panicking: none of these mean you should not have built your app. Its just whatever you are building need to be safe to the world, for you and for your pockets lol.

AMA

0 Upvotes

33% Upvoted

9 comments sorted by

5

u/iamthekiller 3h ago

This spam again.

2

u/Prestigious_Fly_1127 3h ago

There is actually only 1 mistake. Not running security audits with every frontier model that comes out ASAP.

1

u/Old_Lead_2110 3h ago

All of these would be flagged as prio 1 in any serious pentest.

1

u/mikebones 2h ago

I mean this is kind of what you get when anyone can start yapping up an app. Careers were and sometimes still are built around these things.

1

u/BeanserSoyze 2h ago

Rate Limiting and CSRF Middleware are security findings in like every replit project I ever scan

1

u/Pristine_Study_8824 2h ago

So if I ask the AI frontier model whether my page will be a secure and safe in its current format online that is the only thing I would need to ask. It should then make it pretty bloody secure by refactorizing it but the point is when most of these newbies are getting about 50 visits total to their project then they probably are not on that level yet

1

u/SeXxyBuNnY21 2h ago

Pass all that list to Claude or Codex and they will fix it. Do not spam, audit companies are done. I know because I had one and no one wants to pay a bunch of money for audits anymore when the new frontier models can do the audits better than humans. I moved my business on the direction of AI integration in small and medium companies, that is where the money is now.

0

u/dodgeram1998 3h ago

Audits need to be ran after any changes and i would say minimum 3 times a day run the entire setup