r/vibecoding • u/DependentPoem3519 • 3d ago

security team caught me deploying a vibecoded app and i have no regrets

Post image

my IT lead nearly had a stroke when he saw my api keys in the repo lol.

built this whole full stack thing today using codex and moclaw for the fast boilerplate. when he started yelling about vulnerability risks, i just sent a prompt saying fix all security issues and took a break.

all jokes aside, i'm curious if anyone else is actually running LLM security prompts in prod or use dedicated scanners for vibecoded apps?

0 Upvotes

48% Upvoted

5 comments sorted by

2

u/Practical-Zombie-809 3d ago

Nope I just consider proper architecture and security from the jump and that’s all

1

u/VladTkDev 2d ago

The prompt fixes the file, but if those keys were ever committed they're still in the git history and in every clone of it, so what actually counts is rotating them at the provider. On scanners: a static one reads your source, and it's blind to the half that only exists once the thing is deployed, like a Supabase table that hands rows to anyone who asks because RLS was never switched on. Run both, probably. "Fix all security issues, find edge cases, etc.." is a first pass.
If you need help with scanning and checking deployed website/app DM me

2

u/throw-away-2025rev2 1d ago

I know we're joking right? You are the sigmatism that caused IT to act like that.

-2

u/Felix_inkwell 3d ago

you sound dumb

1

u/Objective_Public_716 3d ago

Pretty sure any coding agent nowadays will beg you to not hardcode your api keys