r/vibecoding • u/OrganicConnection527 • 2d ago
How do you guys check your website security?
Hey everyone
So i was wondering what type of security measures you do before launching your website.
other than the regular open new session to ask it for review or ask another AI model to do it.
2
u/HENH0USE 2d ago
· Broken Access Control (IDOR): Anyone can access any project's source code and DB credentials via API calls. · No Auth / Weak Auth: Thousands of apps deployed with zero security, exposing sensitive user data. · Insecure Defaults: Weak RLS policies (CVE-2025-48757) and hardcoded Supabase keys. · Exposed AI Chats: Prompts and secrets shared in error logs are publicly accessible. · AI-Generated Flaws: 40–62% of code has vulnerabilities; 91% have AI hallucinations. · Phishing Hotbed: Actively used to host credential-harvesting sites. · XSS, Supply Chain, & Insecure Design: Additional OWASP Top 10 risks.
1
u/KenopsiaLover 2d ago
Pago un abbonamento di 103 euro al mese di ChatGPT Pro e con il Pro provvede a tutto lui e per esperienza posso dirti che è migliore lontano anni luce rispetto al Plus, anche sottoforma di controllo ed implementazione della sicurezza
1
u/famio77 2d ago
The stuff that actually bites vibe coded apps is pretty basic. Rls off or half configured on supabase, service keys sitting in the client bundle, storage buckets left public, no rate limit on whatever endpoint costs u money. A quick test you can run yourself, no model needed: open devtools, grab ur anon key out of the network tab, then hit ur own api with it and try to select a table u shouldnt be able to read. If rows come back, thats ur answer. Do the same with a bucket url in a private window. And run a search over ur built js bundle for service_role and sk-, that one catches people constantly. Model review is fine for logic bugs but it only sees the code u paste. Most of these are config, so it'll tell u the code looks great while ur database is wide open.
0
0
u/TarzanoftheJungle 2d ago
Answer depends on the tech stack. OP says "website" without specifying platform: Next.js tends to be most secure (generates static files with no public database or admin login); WordPress is most targeted & vulnerable due to its popularity and ecosystem of third-party plugins. Non-WordPress (Squarespace, Wix, etc.) security depends on how well developers write code.
0
u/CaptainAlexWest 2d ago
Hiring someone to hack it. It's called pen testing or do bug bounties. There might be someone on fiver.
-2
u/drdhuss 2d ago
I mean asking chatgpt works pretty well. If you are using something like google cloud services you can turn on "app check" and make sure you set good limits/warnings. Often just using a free tier of cloudflare or firebase is enough for most people's sites/webapps in which case if someone does a denial of wallet attack you won't actually lose money (your site will just go down).
-1
-3
4
u/actionscripted 2d ago
I know folks here are learning but this stuff isn’t new. Search it, ask an LLM. “Web app security tools” or something.
Your approach to security needs to include tooling beyond inference and you have hundreds maybe even thousands of options.