leo: 'guys, I'm under attack'
The canonical cautionary tale, live-tweeted as it happened.
Open x.com →
Building & Product
Thread
Article
Article
Guide
Guide
Article
Guide
Guide
Guide
Article
Article
Article
Article
Article
Article
Article
Guide
Article
Tool
How do I keep my vibe-coded app from getting hacked?
The short answer
AI tools routinely ship apps with API keys in the frontend and database security (like Supabase Row Level Security) switched off; scans found roughly 1 in 10 vibe-coded apps leaking credentials. The fixes are boring and learnable: keep secrets out of client code, turn on RLS for every table, run your platform's built-in security scanner before launch, and never announce 'I built this with zero code' until you have. Real casualties (Enrichlead, Moltbook) show attackers actively hunt vibe-coded apps.
A quick orientation. The real value is below: resources worth your time, from people who've actually done it.
19 resources worth your time
Hacking Moltbook: AI social network reveals 1.5M API keys
Top security researchers dissect the biggest vibe-coded breach yet.
Open wiz.io →Moltbook is a 'live demo' of how the new internet could fail
The mainstream account of what unreviewed AI code cost.
Open fortune.com →Vibe check: the vibe coder's security checklist
The most practical pre-launch checklist written for non-engineers.
Open aikido.dev →A founder's guide to Lovable security
First-party guide to the built-in scanners and what they catch.
Open lovable.dev →11% of vibe-coded apps are leaking Supabase keys (HN discussion)
The scan data plus engineers explaining exactly how leaks happen.
Open news.ycombinator.com →How to secure your vibe coded app: security checklist for founders
Step-by-step hardening you can do without an engineer.
Open fencer.dev →Security checklist for Lovable apps: 15 things to check before launch
Based on an audit that found 10.3% of Lovable apps leaking data.
Open hacknope.com →Best AI security scanner for vibe-coded apps
Compares the scanners that check your app automatically.
Open vibeappscanner.com →I tested every vibe coding security scanner: here's what actually works
An independent bake-off, not vendor claims.
Open dev.to →Vibe-coded Moltbook exposes user data, API keys and more
The security-industry read on the breach mechanics.
Open infosecurity-magazine.com →'Guys, I'm under attack': AI vibe coding in the wild
The full Enrichlead post-mortem with the lessons spelled out.
Open pivot-to-ai.com →Vibe coding has a security problem
Builders sharing which mistakes they personally shipped.
Open indiehackers.com →Vibe coding security risks: why 53% of AI code has security holes
The vulnerability stats behind the anecdotes.
Open getautonoma.com →When vibe coding goes wrong
A roundup of early incidents and the patterns they share.
Open techstartups.com →Vibe coding cybersecurity insight report
Fresh scan data on how many live apps still have RLS off.
Open supaexplorer.com →The real cost of vibe coding in production: a practical survival guide
Security, scaling, and survival tactics in one founder-level doc.
Open shareuhack.com →Vibe coding security risks: what founders need to know before going live
A vibe-coding platform's own pre-launch warnings.
Open getcreatr.com →Aikido Security
One dashboard that scans AI-generated code, secrets, and dependencies.
Open aikido.dev →More in Vibe Coding
- Why can non-technical founders now build software with AI? 18 →
- What tools should I start with (Cursor, Claude Code, Lovable, Replit, Bolt, v0)? 19 →
- How do real founders ship an MVP with AI in days instead of months? 18 →
- What are the limits, when do I still need a real engineer? 20 →
- What actually counts as vibe coding, and how is it different from serious AI-assisted engineering? 18 →
- How do I plan and prompt so the AI builds what I actually want? 18 →
- How do I get my vibe-coded prototype ready for real users? 18 →
- How do I add accounts, a database, and payments to my vibe-coded app? 18 →
- What do I do when the AI gets stuck, loops, or breaks things it already built? 18 →
- How much does vibe coding really cost, and how do I stop burning credits? 18 →
- Do I still need to learn to code, or is prompting enough? 17 →
- Can vibe-coded products become real businesses? 19 →
- Can I vibe code a mobile app and get it into the App Store? 18 →
- How do I avoid losing work? Version control for founders who don't code 19 →