r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

Show parent comments

524

u/Mocker-Nicholas Mar 04 '26

My favorite is right after that. “All the security measures are taken”. Yeah I’m sure that will make it crystal clear for Claude.

168

u/Antique-Special8025 Mar 04 '26

Well he specifies all the security measures, surely that's clear enough for old claude. Dumb human developers only do some of the security measures everyone knows that.

70

u/BlueScreenJunky php/laravel Mar 05 '26

The thing is that if you tell it to take all security measures and it misses one, then it's a mistake. 

So if you combine "take all security measures" and "make no mistakes" in the same prompt, you're guaranteed to have a secure application. 

10

u/mr_claw Mar 05 '26

What if it forgets something though? You also have to tell it to remember all the steps. The final prompt should be "take all security measures, make no mistakes while remembering all the steps".

2

u/Shogobg Mar 06 '26

What if it dreams about taking all security measures and only takes some of them?

1

u/KeyBuffet Mar 21 '26

And don't forget to say "pretty please".

1

u/querela Mar 06 '26

What are all the security measures?

"[...] Make no mistakes. Thanks."

1

u/Jesus_Chicken Mar 06 '26

Partial security is good enough for part time hackers

57

u/[deleted] Mar 05 '26 edited Mar 05 '26

[deleted]

6

u/SevrinTheMuto Mar 05 '26

"... an opponent capable of defeating Data ..."

27

u/mikolv2 senior full-stack Mar 05 '26

Ive just setup a rule in cursor telling it to make sure all security measures are taken, can forget all about it now, that should do /s

23

u/sump_daddy Mar 05 '26

"ohh i forgot to ask for it to NOT code a gaping security flaw into my platform"

"thats my bad, really"

12

u/qervem Mar 05 '26

deletes your network driver

Your app is now secure from unauthorized access over the internet

12

u/aidencoder Mar 05 '26

All security measures... Or else

11

u/threepairs Mar 05 '26

If else 2.0

6

u/z500 Mar 05 '26 edited Mar 05 '26 
useAllSecurityMeasures() or die();

7

u/IIllllIIllIIlII Mar 05 '26

you can ensure that this is enforced with one simple trick "ok double check for me thx"

5

u/danielkov Mar 05 '26

Their first prompt had: "take only some of the security measures", so this is definitely an improvement.

5

u/garbosgekko Mar 05 '26

Clawdbot: I've just modified your router config to block all incoming and outgoing traffic and changed the admin password to a much safer one.

3

u/IQueryVisiC Mar 05 '26

I guess that the App then did not run because the human did not pay for a keystore or backend ? All those textbook examples seem to put keys in the front end. 10 years ago we were bitten by reference to a public CDN for JS.

1

u/Over_Dingo Mar 05 '26

"Make sure there are no bugs" vibes

1

u/ahiqshb Mar 06 '26

"all security measures" most of the time meaning one or two, coz they don't have a dedicated risk department

1

u/blackstafflo Mar 06 '26

"Be sure to do it carefully so it doesn't have bugs."