Vibe-coded game hit by glaring bug: fake 1tn balance via unvalidated /api/send
emeka_boris · x · 2026-10-06
A user exposed a security flaw in a vibe-coded game platform: the new /api/send endpoint lacks server-side validation. You can inflate a bot account's balance to ₦1.1tn with PUT /api/save, then POST /api/send to any player with 1tn — the server accepts it and replies ok:true. The author admits it's obviously vibe coded but laments people ruining the fun.
More from Fun
- Dev quips: LLMs feel painfully slow when you're on Adderall — zack_overflow · 2026-10-06
- Gym treadmill monitor still shows Twitter-era UI years later — nima_owji · 2026-10-06
- Viral debate: creators' anti-AI energy versus channeling it into making new things — AIandDesign · 2026-10-06
- Mistral CEO jokes he's done sending fundraising decks, resonating with AI founders — PTrubey · 2026-10-06
- Meme shows Musk, Altman and Dario begging King Jensen for GPUs — olcan · 2026-10-06
- 'They are waking up': AI model's startling reply goes viral — justalexoki · 2026-10-06