5,000 insecure vibe-coded apps later: the security check to run before every launch
PrajwalTomar_ · x · 2026-10-24
A South African coffee franchise's internal dashboard — reportedly built with Claude — leaked names, contact details for 132 locations, and financial figures in its page source, discovered via employees' Instagram photos and verified by MyBroadband. It's not isolated: WIRED-covered research found 5,000+ vibe-coded apps with essentially no security, 2,000 critically flawed. The author shares a pre-launch checklist, shown in screenshots: scan headers with Security Headers by Snyk, have an agent run a full 8-point OWASP audit (auth, API routes, secrets, dependencies, logging, webhooks) with severity-ranked output, and attack your own login — wrong passwords, fake resets, double link clicks, duplicate signups — to ensure nothing confirms an account exists.
More from coding & agent
- Disappointed with Codex, developer has it write a handoff file for Claude to take over — lxfater · 2026-10-24
- terrio v0.5.0 ships pure Rust geospatial engine with no GDAL, adds SQL and GRIB support — giswqs · 2026-10-24
- DeepSeek Flash-1017 pitfalls: broken budget counting, poor ambiguity handling, 'stingy' mode — karminski3 · 2026-10-24
- When AI agents disagree, who decides? Why the orchestrator shouldn't quietly become the decision-maker — Environmental_Fly371 · 2026-10-24
- A buyer's checklist: 12 questions to ask before adopting an MCP server vendor — pournasserian · 2026-10-24
- Claude Code project structure explained: CLAUDE.md, commands, skills and agents — Aiden_Tech_Ai · 2026-10-24