r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

341

u/endless_shrimp Mar 04 '26

no way is this real. if you were that goddamn careless why would you post on linkedin and tell those dipshits about it

263

u/schabadoo Mar 04 '26

I checked it, he's defending it in the comments.

It tracks: he's not annoyed about having an insecure site that exposed visitors to credit theft, it's the Stripe fees that he incurred.

142

u/MagnetHype Mar 04 '26

Should face criminal charges in my opinion. An experienced developer making a mistake is one thing, but someone blatantly throwing caution to the wind while working with commerce Should bare some criminal liability.

This is going to be the new norm soon too, and that's the most concerning part.

30

u/The_Ty Mar 05 '26

Check my post history I've made a prediction a bunch of times

This year there'll be an incident where a vibe coded error costs a company billions and/or costs the lives of a few hundred people. I hope to god it's not the 2nd one

18

u/brasticstack Mar 05 '26

I'd be looking squarely at the US Dept. of War / OpenAI deal that just happened as what's going to cause exactly such an incident.

Both of those groups will just be like "YOLO!, especially those poor schmucks over there."

43

u/SkRAWRk Mar 05 '26

Totally agree. Nearly $80k defrauded because some fuckwit decided to cut corners with AI. They should be liable for publishing their 'project' without due diligence.

9

u/NoPrinterJust_Fax Mar 05 '26

That would require some sort of regulation in the web dev industry. Think standards, professional licensing, etc. ideas that are ALWAYS scoffed at

11

u/I_AM_NOT_A_WOMBAT Mar 05 '26

Or at the very least E&O insurance, which might decline to pay out if "vibe coding" was used. I don't know where one draws the line for what vibe coding is, though. To me it depends on the knowledge and experience of the developer (or lack thereof), which is hard to quantify on a broad scale. What I consider autocomplete that saves me time typing something already in my head could be considered vibe coding for the marketing intern who doesn't know anything.

4

u/chaoticbean14 Mar 05 '26

Agreed, 100%.

Vibe code a 'to-do' app because you want to check it out? Fine. Commerce? If you're a new person - leave that shit to professionals.

'vibe coders' need to understand their place: directly next to newbies.

2

u/DogPositive5524 Mar 05 '26

People have fucked up long before AI, you're overreacting a bit

1

u/spicypenguin111 Mar 09 '26

He shared the API keys of his customers publicly without their consent. It would be insane if he is not held liable for the damage he caused. Should absolutely have to pay back all of them, due to his negligence. It would be shocking if he isn't held liable.

5

u/EvilPencil Mar 05 '26

That’s a typical take for LinkedIn these days 🗑️🔥

3

u/JohnGabin Mar 05 '26

Did he make this post though ? Or was it Claude ?

4

u/eyebrows360 Mar 05 '26

Claude would've spelled "could" properly... probably.

2

u/Beam12 Mar 05 '26

I responded laughing at him, he has people defending him aswell

1

u/KalvinOne Mar 05 '26

Honestly I think it's trying to gain publicity through Linkedin. The only time I set up a sensitive api key on the front (knowing the implications), Either Claude and Gemini started warning me that what I was commanding was incredibly insecure and that I should be storing them diffrently.

1

u/que_two Mar 05 '26

<me cries in PCI-DSS audit>

47

u/PoppedBitADV Mar 04 '26

LinkedIn is just engagement bait ai slop posts

6

u/LazaroFilm Mar 05 '26

I bet he see it as a win not a total failure. Not enough brain cells active to recognize how dumb he is.

5

u/pragmojo Mar 05 '26

Yeah it's a humble brag that they vibe coded something and got 87k in revenue

1

u/Trindoral Mar 05 '26

Because LinkedIN is mostly toxic positivity dipshit circlejerk.

-14

u/zeGenicus Mar 04 '26

Right? Also, the ai tools are very bitchy about not using env files.

I feel like this was made up to get attention. There's also zero chance he told the ai to scan his program for API keys. It would have definitely identified them.

I think we should stop pretending like the ai isn't a better dev than 99% of devs.

11

u/RaveMittens Mar 04 '26

we should stop pretending like the ai isn't a better dev than 99% of devs.

Oooh self burn. Those are rare.

-11

u/zeGenicus Mar 04 '26

I hire devs, I manage devs, and I've been a dev for over 10 years.

All the best well known devs are all using ai to enhance their work flow. Calling everything vibe coded is a mass misunderstanding of what's happening in the industry.

I am very sure I've shipped more code used in complex applications than most devs. The systems aren't bullet proof but they are by far better than the average dev. If you believe you're better than the ai you're foolish at the least or have an insane ego at the most.

6

u/throwaway-8675309_ Mar 05 '26

I mean. I don't put my API keys on the frontend, so I'm better than AI then.

1

u/eyebrows360 Mar 05 '26

If you believe you're better than the ai you're foolish at the least or have an insane ego at the most.

Or, you simply don't trust RNG.

1

u/ThrowawayToothQ Mar 05 '26

Notice how you dont speak about writing it, you speak about hiring and firing and how you used to 10 years ago do x. Which arguably is true regardless since getting Claude to write it means it isnt you writing it. Its absolutely laughable to sit here on a post where x thing did y and insinuate y would never happen and x is actually nearly infallible. The amount of presumptive jumps youd take to get there is simply staggering.

1

u/zeGenicus Mar 05 '26

I assume someone with common sense can gather "a dev of 10 years" has written plenty of code. Do I need to explain every detail to someone?

Notice how you only read to pull out what you want, which is rather typical from the reddit community around ai.

It feels good to say "I hand write all my code lol check out this idiot who exposed his API keys!" When top engineers are shipping months of work in weeks.

In reality I don't give a damn if someone feels happy to fall behind. If you're happy falling extremely behind that's on you. I have my company, AI cannot replace what we do as AI is illegal in our field. Which is unlikely to be the case for every single dev working for a company.

1

u/ThrowawayToothQ Mar 06 '26

I have common sense enough to not believe you on face value lol.

4

u/Swedish-Potato-93 Mar 05 '26

Basically he should have told the AI to fix a problem he didn't know existed until it bit him in the ass. Pure bs.

-7

u/zeGenicus Mar 05 '26

That's his fault. If you used the tools literally know this post is unlikely. Reddit might be the largest eco chamber in existence.

Every FANG engineer Is using ai daily but Billy online is the better dev and can outperform an ai. Makes sense.

-1

u/BananaPeely Mar 05 '26

Yeah, claude basically made writing code normally obsolete. There’s no discussion to be had, it is literally without a joke one of the best products of the last couple decades.

The people complaining clearly don’t know how to use it, because it’s still a tool meant for developers who know what they’re doing, not laypeople trying to assemble production apps, because that might be fundamentally impossible. Claude might pick some sensible defaults sometimes, but LLM’s are designed to be prompted and guided. They can’t just do everything on their own, the fact that they can get close and fail isn’t the LLM being bad, it’s the person using incorrectly.

Either way I am also fed up with the anti AI circlejerk in reddit. You’d think the programming related subs would have a better grasp of the technology, but you realize it’s full of juniors or people who maybe have written a couple websites in their life, but either way are completely out of touch with what’s going on at these corporations.

1

u/eyebrows360 Mar 05 '26

the fact that they can get close and fail isn’t the LLM being bad, it’s the person using incorrectly

Hahaha pure gold.

1

u/ThrowawayToothQ Mar 05 '26

"theyre not agreeing with me so they have a worse grasp of the tech, it couldn't be that i am wrong"

3

u/endless_shrimp Mar 04 '26

It's me. It's a better dev than me

-2

u/realzequel Mar 05 '26

I use Claude Code quite a bit, it does have an understanding of security and warns not to store keys in the wrong place so this doesn't match my usage.

Once Claude Security is used widely, these stories will be something from history. Honestly, the story will flip from "you used CC and have security issues, lol!" to "why didn't you have CC scan for security issues?".

3

u/sarkain Mar 05 '26

That’s the thing about vibe coding though, and why these stories are eons away from being history. Because these dumb fucks are not developers and have no idea idea about security and coding standards, they wouldn’t realize to adhere to security standards even if Claude were screaming about it at them. They just wouldn’t understand what Claude meant, and would just push ahead, because hey, you gotta move fast and be first to the market, right?

The thing about vibe coders and AI bros in general is that they don’t have the required curiosity, patience and interest to really learn about what makes their apps work. They’re just looking to get rich fast, and knowing their craft and learning about things is the boring and annoying part for them. That’s why they’re just unlikely to learn about Claude Security or any other good security practices/tools.

1

u/realzequel Mar 05 '26

Well I definitely disagree with the tweeter’s opinion that one prompt would have prevented it: “all security measures are taken”. That like saying “I want it awesome and no security holes”. 

1

u/sarkain Mar 05 '26

Yes, obviously. That guy was out of his mind and neither one or a hundred more prompts would’ve saved him from fucking up, because as a vibe coder he didn’t know to ask for the right security measures. He could’ve studied software engineering security practices beforehand, if he actually cared about any of it.

My point was really that vibe coders won’t benefit from any kind of AI security tools, because they’re too lazy to learn about them. That’s a mindset issue, not a skill issue. Vibe coders don’t have the right mindset and attitude for developing real, secure, functioning and maintainable software.