In this era of AI we can ship faster then anything we can ship a full product in just 24 hours but we forgetting about security this 2026 till now there nearly half of all AI-generated code contains vulnerabilities, with recent data breaches exposing sensitive records due to exposed API keys and missing authentication

so yesterday i made a post asking you guys to drop your vibe coded projects so i could have a look

didn't think that many people would actually send them ngl 😭

anyway i went through all of them and bro i kept seeing the same stuff on almost every single site so i had to make this post

rate limiting bro PLEASE

this was on literally every website i checked

like ALL of them. only one site had it. one.

if you have a contact form or a signup page with no rate limiting anyone can just spam it endlessly

they will burn through your email credits drain your AI tokens run up your bills and you won't even know until you wake up and check your dashboard 💀

some of you are thinking ok i'll just limit by email

nah that doesn't work

there are tools that can change the email on every single request automatically. i bypassed that in like 2 minutes

rate limit by IP. not email. IP.

no email verification after signup???

if you don't verify emails after signup anyone can create an account with anyone else's email

just add it. takes like 20 minutes to implement.

your API keys are just sitting there

open inspect element. go to sources. search for key or secret or supabase or openai

if you can see your keys there so can everyone else

and they can use them however they want. and YOU get the bill 💀

i'm only just getting into cybersecurity. i'm not some elite hacker

i did this just to practice and have fun and honestly loved it

but if i'm finding all this as a beginner in 10 minutes just think about what someone actually malicious could do

thanks to everyone who let me poke around your projects fr 🙏

build fast. just don't ship naked

[ Removed by Reddit on account of violating the content policy. ]

Been building with Cursor for the last 3 months.

Shipped fast. Everything worked. Felt great.

Then I got bored one night and actually read

through the code it generated.

Some things I found:

My entire database was queryable by anyone with

my Supabase anon key. RLS was disabled on 6 tables.

I disabled it myself during prototyping because

Cursor told me to "to fix the permissions error."

Never turned it back on.

req.body was being passed directly into

db.user.update() on my profile endpoint.

Meaning anyone could send { "isAdmin": true }

and it would just... work.

3 API routes had zero auth middleware.

The dashboard redirected you to /login if you

weren't logged in. The actual API behind it

did not care at all.

My OpenAI key was in a file that had been

committed to git 47 days ago. I had since

moved it to .env. The commit history

still had it.

None of this was Cursor's fault honestly.

It wrote exactly what I asked for.

I asked for a working profile update endpoint.

It gave me one. I never said "make it secure."

The problem is we're shipping production apps

the same way we build demos. Fast, iterative,

"fix the error" driven. Security doesn't

show up as an error until someone exploits it.

Checked my Supabase logs out of curiosity.

Two IPs I didn't recognize had queried my

users table directly via the REST API.

Nothing was taken as far as I can tell.

But they were in there.

Anyway. Go read your AI-generated code tonight.

Specifically look for:

- Any .from('table').select('*') without

a .eq('user_id', x) filter

- Any route.ts files that don't start with

const { userId } = await auth()

- Any db.update() that receives req.body directly

- Your git log for anything that looks like a key

Not trying to scare anyone. Just sharing what

I found when I actually looked.

We move fast. Worth checking what we left unlocked.