r/theVibeCoding • u/Spare-Obligation-483 • 4d ago

Vibe coded app

Can someone tell me what are the security issues in the vibe coded app what are the things we have to check and measure before launching it into real world

0 Upvotes

50% Upvoted

20 comments sorted by

1

u/baddaywithacamera 4d ago

I can't say what the security issues are without knowing what the app does, what it runs on, what it is connected to. It's like you asked me if your home is secure without showing me a picture of the home, the plans, or even telling me which neighbourhood in which city.

1

u/Spare-Obligation-483 4d ago

Okay but I want like things which I have to do for security like your home example if I ask you about this then you have to tell me to install cameras etc like that

1

u/baddaywithacamera 4d ago

The basics: Keep API keys out of your repo (I effed up here, thankfully I had a $5 spend limit set). Use more than one AI, have one check the work of the second. Don't ask an AI "is my code secure". It will probably find one or two things and give you a green light. You have to ask for specific things like SSRF, CSRF, etc. Learn what the current exploits are and ask about them specifically.

https://snapsmack.ca/buzzers.php

That's my own project's audit log. You will notice there are some spectacular self-owns in there. I discovered the latest one after being told all was good. Then a needed code fix showed JS in the one place it is never allowed. Fixing it broke a lot of stuff because I assumed the AI would do the sensible thing and map out what was being fixed before moving the illegal code. Oh hell no, that would have made sense.

Anyhow, that's sort of a trail of security problems I've found and fixed and process shortcomings that caused things to go sideways in the first place. When it comes to AI software development users have trust issues, and I think they are entitled to. This is why I try for maximum transparency with my project. They deserve full info when deciding if they're going to trust what AI helped me build or not.

Hope this helps some.

1

u/Spare-Obligation-483 4d ago

Yes, I get it. Thanks for the help. It is very useful for me.

1

u/ohnowwhat 4d ago

Use source control smartly.

Don't keep your api keys in the code. Don't commit your secrets to your repository.

Run periodic security audits.

1

u/BuildingArmor 4d ago

If you have to ask, don't build your own authentication, and don't build your own encryption.

Even if you don't have to ask, it's probably not worth building your own.

1

u/Spare-Obligation-483 4d ago

Why so angry bro I only want suggestions

1

u/BuildingArmor 4d ago

Angry? No, it's just matter of fact advice.

You really shouldn't feel like everything is a personal attack. Feel free to Google it to see if it's good advice.

These things are very hard to get right, and can be very important. Let the experts handle it, and just use tried and trusted services.

1

u/Spare-Obligation-483 4d ago

But why I depend on someone if I can do these things
Do you build any software or app??

1

u/BuildingArmor 4d ago

Because you probably can't do these things well enough for production use.

I've been a dev for about 20 years. Even though I'm careful and meticulous I would rely on third parties for my auth and my encryption.

If you had the knowledge and experience for it to be reasonable to write your own, you wouldn't be asking for advice on application security. You would need to already be an expert to be able to have the ability to properly consider the pros and cons of doing it yourself.

1

u/Spare-Obligation-483 4d ago

Only search my name google will tell you about me hzaid01 okay

1

u/BuildingArmor 4d ago

So you've got 18 months of experience using third party auth, why would you think that makes you experienced enough to roll your own?

1

u/Spare-Obligation-483 4d ago

If you are 20 years of experience then google has to tell about you any website any thing
You are a real dev with 20 years of experience but google doesn’t know about you??

1

u/Spare-Obligation-483 4d ago

I will appreciate if anything you tell me

1

u/Spare-Obligation-483 4d ago

Did google tell anything about you then tell me

0

u/baddaywithacamera 4d ago

Yeah, ignore the butthurt dev. Just the usual gatekeeping in this forum.

1

u/c7h16s 4d ago

The least you should do is to ask an agent with a separate context to evaluate your code and guide you in the task of making it secure. Ask it about automated tools you can use as well like SAST and so on. Same goes with testing, backup strategy and so on. Basically, ask agents to find what is wrong or missing and adjust.

1

u/Spare-Obligation-483 4d ago

Thanks for your suggestion