u/IsAceDead

Been doing security testing as a hobby (HTB, bug bounty) and got curious what happens when I point the same techniques at apps built fast with AI coding tools. Poked at a few side projects people have shared publicly.

The pattern: the actual UI/UX is usually nice, these tools are genuinely good at that. But auth checks and input handling are where things break. A few recurring ones:

• Object IDs in the URL with no ownership check (so /orders/104 - /orders/105 just... works, for someone else's data)
• Form inputs going straight into a query or straight back onto the page, no sanitization
• Missing basic security headers, verbose errors leaking stack traces

None of this is a knock on vibe coding as an approach, it's just not what these tools are optimized to catch, the same way a fast home renovation might skip a wiring inspection.

Put together a sample report on a public test app(OWASP juice shop) to show what an actual writeup looks like, in case anyone's curious what this kind of testing produces: https://drive.google.com/file/d/10NWU0JvY_TPaDmGNTjK_Wdo-BM4hcrE3/view?usp=sharing

If anyone's shipped something and wants a second pair of eyes on it before real users touch it, happy to take a look, one-time check or ongoing. Otherwise, curious if others have run into the same patterns.

I do web application penetration testing. Finding real security holes (SQL injection, broken access control, XSS, that kind of thing) before someone else finds them for you.

Who this is for: small businesses, indie SaaS founders, and anyone with a live web app who's never had a proper security review.

What you get: a written report, what I found, how bad it is, exactly how to reproduce it, and how to fix it. With actual proof-of-concept and remediation steps.

Sample report (tested against a public training app, not a real client, just to show the format): https://drive.google.com/file/d/10NWU0JvY_TPaDmGNTjK_Wdo-BM4hcrE3/view?usp=sharing

Rates: $100-500 flat for a single web app / $250-1000 for recurring quarterly testing, happy to scope a fixed price after a quick look at what you've got.
Turnaround: 10-20 business days from kickoff to report.
Process: signed scope-of-work agreement before any testing starts (covers both of us and defines exactly what's in bounds).

Background: 70+ machines on HackTheBox, active on Hacker One, currently working toward OSCP.

Payment: PayPal

Happy to answer questions in comments or DM.

Need some people who:

1. Have good communication and persuasion skills

2. Are willing to spend a good amount of time

3. Are looking for some extra income on the side

Payment would be through UPI
The work would mostly be text based. If interested, please DM me