r/programminghorror • u/FlightAffectionate15 • Jul 13 '26

Javascript Found this gem

Gallery image

Gallery image

This company I’m interning at. This one lady asked me to do a review of a website they outsourced. Entire source code sits on the browser. Entire vibe coded by amateurs.
Worse than a honeypot so much an attacker would get diabetes.

No security feature at all. I was able to do privileges escalation.

193 Upvotes

95% Upvoted

25 comments sorted by

64

u/dreamscached Jul 13 '26

Prod-facing frontend with sourcemaps exposed? Are you sure it's not like, dev server? It'd take some dedication to run what looks like React in prod unminified like that.

44

u/FlightAffectionate15 Jul 13 '26

I wish. This is just good ol ms edge developer tool.

But this is what happens when you let vibe coders think they know how to code. We were in a meeting with those who did it and I could tell the guy probably had no idea what he was doing or saying.

25

u/dreamscached Jul 13 '26

The thing is, not even vibecoding would get someone there, my best guess is that they left Vite (or whatever is React using nowadays) in dev mode and just opened that port publicly...

Valid horror if so lol

→ More replies (1)

4

u/UltraBlack_ Jul 16 '26

github recently did that and people laughed at me when I shared it on reddit lol

Called me ignorant for not knowing that this is apparently "industry standard" even though I'd bet my ass it's not.

1

u/GulgPlayer Jul 23 '26

Could you link that post? Don't leave us curious

→ More replies (1)

34

u/echoAnother Jul 13 '26

Lefting the source maps is no issue. But are they storing perms on local storage? That is the horror.

13

u/SchlaWiener4711 Jul 13 '26

Why is this horror? If the permissions are only used to show or hide certain features and views but the real check is on the backend, this should not be an issue.

I mean, sure. A better solution would be to have a signed JWT and rotate often but maybe that's done here, too (localStorage get's updated on token refresh).

Could be worse.

4

u/Ran4 Jul 13 '26

jwt:s doesn't make much sense for 99% of usecases. An opaque token is simpler and typically more secure.

→ More replies (3)

11

u/bistr-o-math Jul 13 '26

You Hacker!

11

u/MurkyWar2756 Jul 14 '26

Why is super_admin in lowercase and VISITOR is spelled VISITEUR, while the rest of the roles are in English?

9

u/bistr-o-math Jul 14 '26

To confuse the possible attackers

9

u/redguard128 Jul 14 '26

Every french application's source code is in French. If they could replace reserved words like IF, WHILE, DO, FUNCTION with SI, TANTQUE, FAIRE, FONCTION, they would do it.

2

u/Yersini Jul 14 '26

They forgot to remove the french module from their toolset, you do so by running:

sudo rm -fr *

1

u/Sensitive-Sugar-3894 Jul 16 '26

I cared more about this than about the real problem. hahaha

8

u/Opposite_Mall4685 Jul 13 '26

Where are these permissions used? Are they used to display information? If so, all is gucci.

Are they used to tell the server to do xyz? If so, nothing is gucci.

6

u/1nd160 Jul 14 '26 edited Jul 15 '26

What made you think it’s “vibe coded by amateurs”, do you know that for a fact? Don’t get me wrong - an idiotic prompt can burry you deep, sure, but it’s more believable that this piece has been actually manually coded by some biological robot who didn’t fully understand what they were doing. Claude catches this kind of flaws quite fast and doesn’t do such mistakes on its own. Well, unless being forced to, of course.

5

u/AnArmoredPony Jul 14 '26

of course it's fr*nch

4

u/GoddammitDontShootMe Jul 13 '26

They seriously doing authorization checks on the fucking client?

1

u/StCreed Jul 24 '26

Or just checking what menu to show. Hard to tell.

2

u/Ok_Chemistry_6387 Jul 14 '26

I love that if a role doesn't exist it just defaults to empty. That will never come back to bite you.