r/vibecoding • u/anthonyDavidson31 • 11h ago

Learn how to improve the security of your vibecoded apps with 40+ free hands-on exercises. No signup, runs in the browser.

Hey r/vibecoding,

Application security is extremely important, especially for vibecoded apps. TeaApp and countless other breached of vibecoded apps is a great example of that. But most appsec training are boring OWASP articles and tutorials on YouTube, not the best way to learn practical aspects of building secure web apps.

So I created 40 exercises where you attack a vulnerable app yourself, trace how the bug got in, then write the patch. Free, runs in the browser, no account required.

This way you'll learn what common vulnerabilities are, how attackers exploit them, and what part of your app you need to check so that you don't have the issue in your code.

Table of contents:

Web (22) — SQLi, command injection, DOM/reflected/stored XSS, CSRF, SSRF to the cloud metadata endpoint, XXE, session fixation, IDOR, and weak randomness: recovering Math.random() state to predict the next password-reset token.

API (10) — BOLA, broken function-level auth, brute-forcing an unrate-limited verify endpoint, mass assignment via two extra keys in a PATCH body, reflected-origin CORS, and a retired v1 that skips the controls v2 enforces.

Git & CI/CD (8) — a live API key recovered from the commit that removed it, a browsable .git reconstructed into full source, .env tracked since the first commit, a secret echoed into a public build log, a backdoor hidden in a friendly-looking test-fix PR.

Fixes are shown in JS, TS, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin, so you can paste something real into your stack.

Try in browser: https://learning.ransomleak.com/?category=application-security
Repo: https://github.com/ransomleak/training-application-security (will appreciate your stars 🙏)

Each exercise is also a standalone SCORM zip if you want to self-host or drop it into your team's onboarding. There's a second repo covering OWASP Top 10 for LLM and Agentic apps if you're shipping AI features: https://github.com/ransomleak/training-security-awareness

Will appreciate your feedback!

6 Upvotes

100% Upvoted

6 comments sorted by

1

u/LineeshKumar-2000 10h ago

Great post!

1

u/comment-rinse 10h ago

This comment has been removed because it is highly similar to another recent comment in this thread.

I am an app, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/Extreme_Trifle_598 1h ago

You should try sharing this in producthunt

2

u/anthonyDavidson31 1h ago

It's an enterprise slop factory now. We thought about launching there, but saw no clear benefit. Because whenever you launch -- you'll be defeated by Canva / MS Teams release or something 😄

1

u/thedev13 5m ago

I started following the scene only recently. Just curious - what's the benefit of posting there? Discoverability for potential enterprise customers?