Vibe coding has a security problem.
Curated from indiehackers.com →
In March 2025 a founder announced a paid lead-generation product built with an AI editor and no hand-written code. Two days later he posted that it was under attack: the API keys were in the front-end bundle and had been exhausted, the subscription check was a JavaScript condition anyone could step past, and the database was accepting writes from strangers. He took the product down. There is no novel vulnerability here and that is the point: an assistant asked for a paywall produces something that looks like a paywall, because nothing in the request said the check had to happen on a server the user does not control. Every failure in this case is one an experienced engineer would have caught in review, and the working product is what made the review feel unnecessary.
