90% of vibecoded SaaS apps are vulnerable — the four patterns and the prompts that fix them
russopuppo · reddit · 2026-09-21
After reviewing security scans and write-ups on apps built with Lovable, Bolt, and Replit, the author reports that 90% of tested vibecoded apps had at least one vulnerability — and most are embarrassingly basic: database rules, user isolation, backend permissions, and exposed API keys.
The four patterns, each with a copy-paste fix prompt:
- Open databases: auth exists but DB rules leak other users' data via tampered DevTools requests. Fix: audit every private-data table, deny by default, enforce server-side, get identity from verified sessions only.
- Broken user isolation: backends check login but not ownership — changing a project ID in the URL exposes others' data. Fix: verify ownership server-side on every ID-bearing route, never trust client-sent IDs, use one shared authorization system.
- Permissions only in the frontend: hidden buttons don't stop direct API calls by regular members. Fix: one shared server-side permission system, default-block, check roles before any admin/billing action; or use a backend provider (the author uses foundel.dev) instead of rebuilding auth from scratch.
- Exposed secrets: private API keys in frontend builds or public repos, copyable from DevTools. Fix: scan code and git history, move credentials server-side, revoke and replace everything exposed.
More from coding & agent
- Grok VS Code extension now listed on Open VSX and the VS Code Marketplace — PawelHuryn · 2026-09-22
- LLMs Are Too Big: Aronchick on Right-Sizing Models for Log Routing — aronchick · 2026-09-22
- Dev syntax-highlights nested string literals inside a coding agent, making prompts readable again — lucasmeijer · 2026-09-22
- AI Comes for the If Statement: Tomasz Tunguz on AI replacing hardcoded rule logic — hardimanjames · 2026-09-22
- MrKan turns AI agents into kanban teammates for managing multiple projects with guardrails — agf2007 · 2026-09-22
- Thorsten Ball: Code Review Will Die, and Unit Tests Might Follow — rseroter · 2026-09-22