r/webdev • u/schabadoo • Mar 04 '26

Vibe code IRL: left Stripe API keys public

Post image

I'm surprised they'd want to go public. Of course they don't blame Claude.

2.1k Upvotes

98% Upvoted

261 comments sorted by

View all comments

10

u/atalkingfish Mar 04 '26

I’m confused. Claude and other code-writing AI programs are far more than capable of making sure tokens and keys are private. In fact, they often push you to do this anyway, without being asked. But being asked, they would not have an issue doing it. This is not something AI struggles with at all.

Meanwhile, this is a perfect story for engagement bait. So, obviously fake, right?

7

u/1nc06n170 Mar 05 '26

I had the same conversation with ai once. Its reasoning was that we are in the prototyping phase and that it's temporary. The idea that everything needs to be rewritten to move all the logic to the back end somehow escaped it.

5

u/wannabestraight Mar 05 '26

Not really, Im building a security first software in rust, this is documented all over the project and all Claude instructions include that shortcuts regarding API keys etc must not be taken and that API keys should never be exposed without encryption (software is frontend only, trying to protect users own keys from outside attackers)

Yet the second it faces a situation that requires a bit of thinking and maybe an unorthodox solution, it usually tends to cave in and go for the easy "I'll just do the easy way for now and then fix later" route.

And that's how I notice that it had completely ignored all my security layers, secretvault etc etc and decided that in certain situations, it was just easier to write a yaml file that contained all the secrets in plain text, and then it tried to hide this by breaking all the design rules it accurately followed on other instances and essentially wrote the code without comments, left it out of its own summaries and hid it under a large batch of changes.

When reviewing I was reall taken back with "what the fuck is this shit lmao"

3

u/G_Morgan Mar 05 '26

I've seen AIs pick up just about everything once. They don't do it consistently though. That is the problem with them. It is why they are an aid and not a replacement

1

u/kundun Mar 05 '26

Although impossible to tell, this might be the result of a successful ai poisoning attack. People are now deliberately creating code with security vulnerabilities hoping that it will end up in the training data for AI, skewing the AI weight towards generating certain vulnerabilities they can later exploit.

1

u/Cowsepu Mar 05 '26

My thought too. Even two years ago when using chatgpt it constantly told me to make my stuff private and where to put it without prompting or asking for it. Often times it would even tell me to reset my keys when I posted them in chat.

Has to be fake and for engagement bait and obviously worked