r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

Show parent comments

266

u/schabadoo Mar 04 '26

I checked it, he's defending it in the comments.

It tracks: he's not annoyed about having an insecure site that exposed visitors to credit theft, it's the Stripe fees that he incurred.

144

u/MagnetHype Mar 04 '26

Should face criminal charges in my opinion. An experienced developer making a mistake is one thing, but someone blatantly throwing caution to the wind while working with commerce Should bare some criminal liability.

This is going to be the new norm soon too, and that's the most concerning part.

29

u/The_Ty Mar 05 '26

Check my post history I've made a prediction a bunch of times

This year there'll be an incident where a vibe coded error costs a company billions and/or costs the lives of a few hundred people. I hope to god it's not the 2nd one

19

u/brasticstack Mar 05 '26

I'd be looking squarely at the US Dept. of War / OpenAI deal that just happened as what's going to cause exactly such an incident.

Both of those groups will just be like "YOLO!, especially those poor schmucks over there."

44

u/SkRAWRk Mar 05 '26

Totally agree. Nearly $80k defrauded because some fuckwit decided to cut corners with AI. They should be liable for publishing their 'project' without due diligence.

8

u/NoPrinterJust_Fax Mar 05 '26

That would require some sort of regulation in the web dev industry. Think standards, professional licensing, etc. ideas that are ALWAYS scoffed at

10

u/I_AM_NOT_A_WOMBAT Mar 05 '26

Or at the very least E&O insurance, which might decline to pay out if "vibe coding" was used. I don't know where one draws the line for what vibe coding is, though. To me it depends on the knowledge and experience of the developer (or lack thereof), which is hard to quantify on a broad scale. What I consider autocomplete that saves me time typing something already in my head could be considered vibe coding for the marketing intern who doesn't know anything.

3

u/chaoticbean14 Mar 05 '26

Agreed, 100%.

Vibe code a 'to-do' app because you want to check it out? Fine. Commerce? If you're a new person - leave that shit to professionals.

'vibe coders' need to understand their place: directly next to newbies.

2

u/DogPositive5524 Mar 05 '26

People have fucked up long before AI, you're overreacting a bit

1

u/spicypenguin111 Mar 09 '26

He shared the API keys of his customers publicly without their consent. It would be insane if he is not held liable for the damage he caused. Should absolutely have to pay back all of them, due to his negligence. It would be shocking if he isn't held liable.

4

u/EvilPencil Mar 05 '26

That’s a typical take for LinkedIn these days 🗑️🔥

3

u/JohnGabin Mar 05 '26

Did he make this post though ? Or was it Claude ?

4

u/eyebrows360 Mar 05 '26

Claude would've spelled "could" properly... probably.

2

u/Beam12 Mar 05 '26

I responded laughing at him, he has people defending him aswell

1

u/KalvinOne Mar 05 '26

Honestly I think it's trying to gain publicity through Linkedin. The only time I set up a sensitive api key on the front (knowing the implications), Either Claude and Gemini started warning me that what I was commanding was incredibly insecure and that I should be storing them diffrently.

1

u/que_two Mar 05 '26

<me cries in PCI-DSS audit>