Secure your vibecoded apps
Hey, little background I’m a cybersecurity student and i would like to bring awareness to you people trying to sell a vibecoding app or has already clients. Spend some time going over the best practices to secure your app but most importantly your database. The shown images is from an app that has over 90 paying users and growing but after perform very basic reconnaissance on the binary and website i discovered that his entire firebase was public basically, exposed private key and public. His entire admin dashboard containing his users information were exposed to the internet along with a trial key, the database also exposed his sparkle appcast.xml with old versions when he was starting making it easy to find bugs (btw his personal information was there too along with Apple signature) Well the bugs were massive loopholes too allowing me to skip their paid license of $100. Before commenting I did something unethical I did not cross over the grey line, all I found was publicity available so make sure to erase your appcast.xml history when you reach stable version if you use it. Yes, I dm the person and commented in a lot of their post and no response and they still haven’t fixed it.
已收集讨论
Name the app!
Name the app! GlassCode. You can find the now deleted post here and see OP warning the dev about the issues in the comments
This is the risk a lot of people, at different levels, fail to understand. A "good idea" is not enough, if you still can't fully understand and own the outcome. We'll see more and more and bigger issues.
It really just goes to lazy people, the services we can use have a lot of documentation and a little extra time spent to review or test as if you were the users helps.
Let me know when you’re looking for a summer internship in Cybersecurity
im free but I would be skeptical to work with someone i've met in reddit lol
and they still haven’t fixed it. What do you expect from vibe coders lol
lol I’m sure they are happy to just walk away with their $3k already made and leaving their users disappointed
Best rule regarding security: can't leak data you don't collect.
Incerdibly based
charging 100 bucks for an app when your entire firebase is public is actually criminal 💀
This is the exact reason why I’m so hesitant to release any of the vibecoded apps I’ve built. I usually just build stuff that makes my life easier and share it with colleagues if needed..
To my mind, this is the entire point of vibe coding. There are an infinite number of case-specific reasons one might need or want an app and being able to throw something together for yourself to use locally is amazing. In my case, I am drafting two books and I needed something to help me store and organize my fragments in a specific way, so I spent a weekend with Claude and made something that works well for me. We live in an incredible time… it’s the need and the greed produced by capitalism and our constant desire to buy and consume shit that causes the issues
I'm sure the vibe coder would if they knew how to read code.
I’m pretty sure you aren’t supposed to web pentest without explicit permission.
Passive DNS lookups are not illegal, I didn’t need to force myself into anything it was just there like a domain open
You did the right thing, and they should be thanking you. I hope people realize the gravity of this—when user data and security are on the line, stop vibe coding and start taking it seriously.
Sadly, this happens way too often.
Well done for raising awareness ✌️
Or just don’t vibecode
To be continued
Shitty careless devs have always existed, AI only makes them create faster...
Exactly. I even recommend at very least run security ai agent to check the common issues in your app.
Most important rule nower days. I'm front end app developer and was always impressed by our security guys.
Before launch, Adversarial reviews and Multiple agent reviews focused on security would eliminate 99% of this...