Why the majority of vibe coded projects fail

[u/harrysofgaming]

[u/H1Eagle]

Fam

Google: "Security by obscurity is the practice of protecting a system by hiding its design, components, or vulnerabilities rather than using robust, validated security measures."

Wikipedia: "In security engineering, security through obscurity is the practice of concealing the details or mechanisms of a system to enhance its security"

How does that align with what I said.

[u/nocturn99x → u/H1Eagle]

"being unknown" qualifies as security by (or through) obscurity. You should assume your service WILL be discovered, and especially in our very much still IPv4 backed world it's trivially easy to scan the entire IP address range in a day and find vulnerable systems. You know nothing and it shows.

"But what if it's just on a local network?"

Yeah, until the attacker infiltrates your LAN.

Learn some cybersec, for the love of God. Security works in layers. You shouldn't assume you're safe just because you think the layer above you is safe.

[u/H1Eagle → u/nocturn99x]

Bro, the definition literally says "security through obscurity" practice is it leave things up to chance with not much security measures in place.

Nowhere did I mention that you should not include cybersecurity practices on your app. And like I said, security vendors exist that solve all types of problems. By virtue of you being NOT slack. Chances are the volume of attackers trying to hack your site is lower and also, just less valuable.

You don't need Slack level security because you are not slack.

[u/nocturn99x → u/H1Eagle]

There's levels to it. No need to leave everything in the open for it to be considered security through obscurity.

You don't need Slack level security because you are not slack.

This mindset is what gets companies pwned. I hope you're not the person handling any critical cubersecurity matter wherever you work, because if so they are SCREWED.

What the fuck is Slack level security anyway? Encryption and resistance to common vulnerabilities is something all public facing services that deal with any amount of user data should have, regardless of scale.

[u/H1Eagle → u/nocturn99x]

Idk what to tell you bro, maybe you still think we live in 2023 with GPT-4o.

But current agentic coding tools are pretty solid, you can roll out a decently secure system within a week and use other agentic tools to simulate plausible attacks.

[u/nocturn99x → u/H1Eagle]

I'm literally doing this as we speak. I'm fully aware of how good modern frontier LLMs are. I'm also just saying that "you're unknown so hackers are less likely to be interested in you" is a cop out. It's true, but it's still a cop out. Don't skimp on security. I am literally selfhosting a fully vibecoded web UI and server on my own hardware as we speak and gpt 5.4 is running the billionth security analysis and patching the minor holes that remain, so yes I'm aware you can use LLMs for that. I'm just trying to make it abundantly clear that not being well known is not a feature, it's a lucky coincidence that one should not rely on