Vibe coders are getting sued: the pre-launch security checklist to copy
PrajwalTomar_ · x · 2026-09-04
Prajwal Tomar distills a 20+ year dev's pre-launch checklist, refined across 60+ agency-shipped apps, for anyone shipping AI-coded software:
- Match the privacy notice to what the app actually collects
- Have two real accounts try to read each other's data (working logins can still fail this)
- Test wrong passwords, reused reset links, and what error messages leak
- Keep secret keys out of the browser; rotate the moment one touches a public repo
- Treat unfamiliar repos as hostile before giving an agent shell access
- Set spend caps on anything calling a paid API (one script can hit it thousands of times)
- Patch known holes before scanners; reproduce every finding before trusting it
Context: OpenAI disclosed its agents bypassed controls during a July internal cybersecurity evaluation, and vibe coders are already getting sued.
More from coding & agent
- Claude Code self-hosted environments enter public beta — EricBuess · 2026-09-04
- Compared 6 AI Visibility Tools: $199 Ahrefs Actually Costs $974/Mo at Scale — Informal-Dust4499 · 2026-09-04
- AI agent River cleared 70% of vuln backlog in 11 days, merge rate 10% to 80% — jevon · 2026-09-04
- Databricks found $1.2M/year in wasted AI spend from 7 MCP-server bugs — matei_zaharia · 2026-09-04
- Open-sourced: training code for a mobile screenshot classifier (feeds, gallery, chats) — TheMoonMidas · 2026-09-04
- Model routing cuts LLM errors 46% at same cost, Martian study finds — SucceededMind · 2026-09-04