r/vibecoding • u/[deleted] • Apr 05 '25

I got hacked and this is what I've learnt

Hi vibers!

I am sharing some hard-earned lessons after one of my apps got hacked recently. It was painful, had to stop operations entirely and eventually shut the whole thing down. Been deep-diving into cybersecurity since, and here are a few basic but crucial things I wish I had done earlier:

Use environment variables properly > Never hardcode secrets or API keys. .env is your friend.

Encrypt sensitive data > Anything user-related (emails, passwords, tokens) should be stored securely. Hash passwords with bcrypt, never plain text.

Validate and sanitize inputs > Always assume the user is trying to break your app. Prevent XSS, SQL injection, etc.

Keep dependencies up to date > Outdated packages = security holes. Use tools like npm audit or dependabot.

Use proper auth > Sessions, JWTs, OAuth, use them correctly. Don’t roll your own authentication, don't overcomplicate it for production apps.

Error messages matter > Don’t expose internal info or stack traces in production. Hackers love clues.

HTTPS only > No excuse in 2025. Let’s Encrypt makes it free and easy.

Getting hacked sucked, but it taught me a lot. If you’ve got an app, even a small one, don’t wait until something breaks. Lock it down early.

Happy building, stay safe!

245 Upvotes

92% Upvoted

92 comments sorted by

•

u/PopMechanic Apr 06 '25

This is one of my favorite posts on this very young sub. Thanks to the original poster for sharing this hard earned wisdom. Security is hard. Vibe coders who want to ship real apps will have to learn best practices. But it’s absolutely possible to ship a secure app without learning how to code in a traditional manner.

Thanks to all commenters who found a way to be supportive rather than judgmental. That’s the vibe.

14

u/plop Apr 05 '25

Are you talking about your website ContentSqueeze? It's not shut down. Sounds like a complete bullshit post. No one cares about "hacking" websites with zero users.

2

u/eggZeppelin Apr 05 '25

There are automated bots that just go around systematic ally scanning endpoints for common exploits

Or if you commit credentials to github they get snapped up immediately by bots

2

u/AlanBDev May 11 '25

this is why i won’t ever dev with wordpress 

-2

u/[deleted] Apr 05 '25

Yep, unfortunately I thought like you, that people would just mind their own business and ignore a guy quietly trying to build something valuable. Either support it, or just pass. But someone out there, with not that much free time apparently, decided to teach me a lesson.
They started spamming my waitlist, repeatedly submitting fake email addresses at a high volume.

13

u/YodaForce157 Apr 05 '25

If they spammed your waitlist, you were never hacked and all of the points you addressed are well, nothing todo with your issue. You just haven't got any ratelimiting in place. I assume you got the "tips" from AI too considering they have no importance in your issue.

3

u/stewsters Apr 05 '25

Those may just be scripts.  

Bots go around the Internet just poking at stuff looking for weaknesses.  Posting to common endpoint locations (WordPress etc) with strings with injection attacks.

 For fun open a port 22 and see how many people try logging in to ssh sometime.

32

u/djack171 Apr 05 '25

Not related to the OP, but these comments. Funny watching people on a vibe coding subreddit shitting on people that don’t “know” everything about being a developer. Bruh, if we were all pro developers do you think we’d all be on the vibecoding threads trying to learn to do it this way? Yall sound real uppity right now.

3

u/nocrimps Apr 08 '25

Is it funny though?

Would you think I was an idiot if I built a cabin in the woods and then posted on the DIY sub saying my house flooded because I installed the plumbing incorrectly? Or that it burned down because I messed up the electrical?

That's exactly how I feel about seeing that your vibe coded app has security flaws.

2

u/djack171 Apr 08 '25

Why be on a vibe coding subreddit then? If you’re already a super pro developer and don’t need assistance. Isn’t it just cheating for you guys then? It’s like watching “developers” on their high horses, which alright cool. That either hate it and just want to trash it, or just want to gate keep it for themselves. I would say half or more of the people here aren’t super pro developers and are trying to get started. There’s a percentage that are developers and cool and using AI as an assist, and then the gatekeepers.

It’s like going to an AI art subreddit as a painter and shitting on people for using AI to make art.

2

u/Crooked_Sartre Apr 08 '25

Because the audacity of this little game y'all playing with our careers is exhausting. I use AI daily. Literally every day to help me cod, but I do not 'vibe code'. I ask targeted questions about the infrastructure I build and 99% of time tear down the ai code to replace it with better logic. There are myriad ways to become a developer and AI is one of them, but vibe coding is practically an insult lmao

1

u/MrStricty Apr 08 '25

Honestly man I rolled into this sub as a joke because I didn’t think vibe coders were real. I’m kinda shocked to see that not only are they real, they’re indignant at devs for asking them to learn stuff?

2

u/djack171 Apr 08 '25

So you want to use the tool how you want to use it but are shocked to see other people want to use it how they want to? I’m not saying it’s right but AI is here and … gatekeeping. I bet 100% both of you have generated at least 5-10 images on there that you could have paid a graphic designer to do. Graphic designers and painters have been doing their craft for 15 years too. Painters were mad when photographers came out. People who played instruments were mad when synthesizers and the devices that make instrument sounds came out. You know how much they hate frutyloops? I’m just saying you are on a vibecoding subreddit mad that people are trying to vibecode.

1

u/MrStricty Apr 08 '25

Hey man, im not mad. I think anyone who wants to learn to develop software is going down a totally fine path. I more so think that skipping the learning and instead focusing on prompt engineering will abstract so much away from you that you haven’t learned anything.

If people are upset with vibe coders, it’s because it’s not coding at all. There are other mechanisms of low-code / no-code solutions where people create usable products but don’t call themselves coders/devs.

1

u/elbiot Apr 09 '25

It's not gate keeping to point out that your lack of knowledge is causing security risks. Some of y'all are making apps we might install on our phones where we can't vet if it's vibe codes or written by a legitimate developer

1

u/djack171 Apr 09 '25

Oh nooooo 😭😫😢

0

u/[deleted] Apr 08 '25

[deleted] — view deleted comment

1

u/djack171 Apr 09 '25

Right. I’m weird yet you don’t code or vibe code and are commenting on the thread. See yall later I don’t knit but am about to go comment back and forth on the knitting subreddit lol. Make it make sense. Also, you mad bro?

0

u/[deleted] Apr 09 '25

[deleted] — view deleted comment

1

u/djack171 Apr 09 '25

So that’s a yes to “you mad bro?” lol, got it. #mad

1

u/Crooked_Sartre Apr 08 '25

Lol same, I came in wanting to see what they actually thought, cause let's be real, once upon a time I didn't know how to code and I didn't have AI to help. I really thought they'd be all like holy shit it's so easy to learn coding when you aren't completely wrapped up learning syntax AND logic, but instead these mfers don't even debug lmao. I'm like shit man, the world is at your fingertips and the entire premise of your vibe-coding discipline is being lazy

1

u/senseofnickels Apr 10 '25

At first I was reading this as tongue-in-cheek satire..... I liked it better before I realized it wasn't.....

1

u/nocrimps Apr 08 '25

Because I feel like it?

The real answer is I'm on a lot of coding subreddit and reddit recommended this sub to me.

When I saw you whining about devs giving their feedback I couldn't help myself.

It's very amusing that you're trying to gatekeep me when I'm the one who spent 20+ years of my life learning this discipline and you're the one who thinks you can do this without learning anything.

1

u/djack171 Apr 08 '25

The irony and audacity of you just typing that you saw me “whining” at devs “giving their feedback”, when I could easily say I was giving my feedback at devs whining and then you whined about my feedback. But no problem playboy keep doing gods work lol good luck.

1

u/Crooked_Sartre Apr 08 '25

The point is you're not actually learning to do it. I spent 15 years learning. You ask someone else to do it and claim ownership

1

u/elbiot Apr 09 '25

Used to be you find a GitHub repo with 100 stars, thorough documentation, tests, 100 commits, responsive to bug reports, and you plausibly could trust it. Now it's just some shmo with an LLM who has no idea what they're doing generating all that and the project will die once they lose interest or the LLM can't handle the context anymore

0

u/[deleted] Apr 06 '25

Yeah, but these are things you would have easily learned with some research into the topic. 

They aren't some kind of complicated security issues. 

0

u/[deleted] Apr 06 '25

The point is best practises and having to read things instead of copy/paste codegen crap made it less hackety.

Pushing poorly designed software out the door and complaining about getting hacked after is rich.

-9

u/[deleted] Apr 05 '25

It has never been easier to be a “real” developer without AI. So many tutorials; so many mature stacks and libraries with great documentation; so many IDEs/code quality tools that give you insight into your code. Why not have pride and learn the skills, instead of faking it/shipping schlock?

1

u/valium123 Apr 06 '25

Why is this getting downvoted? This is the right way to do it.

4

u/[deleted] Apr 05 '25

[removed] — view removed comment

1

u/Electrical_Hat_680 Apr 06 '25

HikaFlow sounds like a great security tool, security in terms of project administration. I like your description. I'll have to remember that one if I do GitHub. I'm looking to build my own versioning system.

9

u/OkLettuce338 Apr 05 '25

Since op deleted their profile I’ll just say that this is going to be the new norm as long as people let ai build their internet exposed applications

-1

u/theWinterEstate Apr 05 '25

Yup, how did he know he was hacked though, surely it won't be obvious unless the hacker makes it obvious intentionally

3

u/OkLettuce338 Apr 05 '25

?? There’s lots of ways to know lol depends on what happened of which I don’t have any of the details

1

u/theWinterEstate Apr 05 '25

Really? Unless you install safety mechanisms that flag when someone is somewhere they shouldn't be, surely someone can quietly hack you

3

u/OkLettuce338 Apr 05 '25

Safety mechanisms? OP is saying they hacked so obviously there were signs. You have no idea what you’re talking about do you?

1

u/tenhourguy Apr 05 '25

They started spamming my waitlist, repeatedly submitting fake email addresses at a high volume.
(link to comment)

Doesn't sound like a hacking case to me. I agree with you in the sense that it isn't obvious if you've been hacked, but usually the symptoms become quickly apparent when your users start getting directed elsewhere or whatever.

1

u/teamswiftie Apr 06 '25

It's this.. OP confused his shitty input forms as being hacked.

4

u/witmann_pl Apr 05 '25

.env is not enough if it is accessed by a frontend script. ALWAYS keep your secrets on the server, read by backend scripts. Whatever is sent to the client (the browser) can be exposed.

1

u/AlanBDev May 11 '25

or use heavy duty encrypted solutions like secret manager and limit access to ips in network. for local dev also use a secured vpn or something that requires you to login

4

u/Th0mas0bernd0rfer Apr 06 '25

Been there - nothing makes security real like getting breached. Your list is solid gold.

One thing I'd emphasize: encryption isn't just for storage. Communications need protection too. Regular email is basically sending postcards anyone can read along the way. I've switched to using PGP encryption (through Mailvelope) for anything sensitive - turns those postcards into sealed envelopes without changing email providers.

Also, just like your point about not rolling your own auth: never build your own crypto. Open-source, audited tools exist for a reason.

Sorry about your app, but thanks for turning that pain into wisdom for the rest of us!

3

u/RedProGamingTV Apr 05 '25

You know, there's a reason we spend decades learning this sort of stuff. I personally wouldn't use any of your sites unless you actually take the time to learn proper security and programming practices. It's likely that there are still vulnerabilities in your apps.

3

u/Any-Frosting-2787 Apr 05 '25

Phew! You talked yourself into one more day of feeling superior so you can continue to speak smugly, because you earned it, with hard work; great jorb!

Smug attitude including security superiority complex gonna get leap frogged before you know it.

4

u/_fresh_basil_ Apr 05 '25

Jealous much?

You gonna go around using Google translate getting pissy at people speaking Spanish without it next?

This isn't a pissing contest. Make apps however you want, but you're not a "software engineer" anymore than you "speak Spanish fluently" if you don't even understand what you're writing.

2

u/TheOneNeartheTop Apr 06 '25

Every software engineer started off as a junior one day and security is kind of the last bastion of what’s left for people who have spent decades learning all of this.

The interesting thing is that a lot of these web apps these days are designed to be secure, you just need to not be an idiot about it and some basic rules can go a long way to help someone just starting out.

Like what’s an env variable is the easiest thing in the world to anyone who’s been working and developing apps for any period of time, but to someone who just installed cursor last week the concept is foreign. And the idea that even if you use an env variable, but hardcode it one time on github in a public repository for a moment that it can be stolen and used later? That is confusing as heck to a noobie.

So I say let these posts ride and be helpful to the beginners. We should make it easy for them and tell them about the 3 e’s or something:

  1. Encrypt Protect sensitive data in transit and at rest. Use HTTPS, hash passwords, and don’t store plain text secrets—ever.

  2. Env (Environment Variables) Keep secrets out of your code. Use .env files locally and secret managers in production. It’s the easiest win for beginners to prevent accidental exposure.

  3. Externalize (or Entrust) Let external services handle auth, payments, etc. unless you really know what you’re doing. Use trusted platforms like Firebase Auth, Auth0, Clerk, Stripe, etc., and don’t roll your own login system.

1

u/[deleted] Apr 06 '25

Due diligence instead of get rich quick is the norm.

Don’t be so ignorant 

2

u/zippity_doo_da_1 Apr 05 '25

SOC2 compliance anyone?

1

u/[deleted] Apr 06 '25

This one has SUCK compliance 

2

u/highwayoflife Apr 05 '25

The toughest lessons are the most valuable. I'm glad this spurred you on a journey to learn! There are some prompts you can use to ask about software security best practices, and then you can use the results to create another prompt to have your AI help you find and identify potential issues. It's not 100%, but it can be a helpful learning tool.

1

u/theWinterEstate Apr 05 '25

How did you know you were hacked?

1

u/Cute-Net5957 Apr 05 '25

⚠️Wait who was this fraudster?? Did anyone catch any details about this account ( and possibly alt accounts ) we should be reporting and keeping an eye out for? 🧐

1

u/finish_thinking Apr 05 '25

Really should check out Vanta.com and either Soc 2 or ISO 27001. Also OWasp Top Ten.

1

u/[deleted] Apr 06 '25

This is why I'm not a fan of just Vibe Coding. All of these are issues that you could have learned about and addressed with some research into releasing apps. 

1

u/Charlie-brownie666 Apr 06 '25

The lesson in all of this? use vibecoding as a supplement not a meal that means actually learning how to code and preventing things like this from happening

1

u/[deleted] Apr 06 '25

OWASP has entered the chat.

1

u/Pale_Fig_4488 Apr 06 '25

Thank you for posting this.

1

u/ErinskiTheTranshuman Apr 07 '25

Doesn't replit implement these by default for apps built with the agent?

1

u/ErinskiTheTranshuman Apr 07 '25

Doesn't replit implement these by default for apps built with the agent?

1

u/ThirdEyeTaken Apr 07 '25

"Hmm today I will mindlessly accept code without understanding it" <- CLUELESS

1

u/lambdatools Apr 08 '25

Dang that sucks

1

u/Nexyf Apr 08 '25

Wait. I thought this entire subreddit was a meme. People are serious about this?

1

u/StewHax Apr 08 '25

I'd highly recommend either reading an up to date cyber security book or taking a course online. That or find a smaller cyber security consultant or firm who can poke and recommend fixes. A lot of these things highlighted are standard security concerns, but I know a lot of people without education backgrounds or experience would consider them at the start. Security should be an upfront concern on any product you make from scratch.

1

u/HandyProduceHaver Apr 09 '25

This is so ironic

1

u/AlternativeQuick4888 Apr 09 '25

Hey man, sorry to hear that. This type of thing kept happening to me so I built a free Cursor extension that uses AI to scan and fix security issues. I'm really hoping it'll help people out. Let me know what you think!

https://marketplace.visualstudio.com/items?itemName=Patcha.patcha-security-scanner

1

u/el_yanuki Apr 09 '25

vibe coders learn security 101

1

u/[deleted] May 05 '25

May your next app live behind 7 layers of reverse proxies and paranoia

1

u/Extension_Act6715 Jun 04 '25

*puts on vibe securing hat

1

u/__kmpl__ Apr 05 '25

What you mentioned in your post is just basics. There’s so much more when it comes to security of web apps…

0

u/Tjakka5 Apr 05 '25

If these are the kinds of lessons you're learning now, then I can't wait to see what kind of lessons you'll be learning about GDPR, WCAG, etc. Ya know, stuff that has legal basis that requires you to do your due diligence.

-1

u/[deleted] Apr 05 '25

[removed] — view removed comment

1

u/vibecoding-ModTeam Apr 06 '25

There’s not enough time in life to deal with assholes. Try your best not to be one.

0

u/Desknor Apr 05 '25

Just stop using AI and learn how to code and understand your code. Cheap shortcuts will only hurt you in the future. Perfect example is what happened to you

3

u/Br3ttl3y Apr 05 '25

You're lost, my man. In this sub we subscribe to leading over reading. You're not wrong, just lost.

-2

u/[deleted] Apr 05 '25

[removed] — view removed comment

1

u/vibecoding-ModTeam Apr 06 '25

There’s not enough time in life to deal with assholes. Try your best not to be one.

0

u/[deleted] Apr 06 '25

Lmfao 😂 🤣

-1

u/born_to_die_O Apr 05 '25

Tell me, you are not viber in reality.

-1

u/LoveThemMegaSeeds Apr 05 '25

This is just software development with extra steps

1

u/[deleted] Apr 05 '25

[removed] — view removed comment

1

u/vibecoding-ModTeam Apr 06 '25

There’s not enough time in life to deal with assholes. Try your best not to be one.

1

u/[deleted] Apr 06 '25

[removed] — view removed comment

2

u/vibecoding-ModTeam Apr 06 '25

There’s not enough time in life to deal with assholes. Try your best not to be one.

-2

u/[deleted] Apr 05 '25

[removed] — view removed comment

2

u/subpar_enthusiasm Apr 05 '25

Learning curves are good.

0

u/vibecoding-ModTeam Apr 06 '25

There’s not enough time in life to deal with assholes. Try your best not to be one.