Post by @tyler_ai

If you built your app with Claude, Cursor, Lovable, or Bolt, I can almost guarantee you have at least 3 of these 5 security holes right now. I keep seeing the same mistakes over and over in vibe-coded apps, and most founders don’t find them until a user does, or worse, until they wake up to a $2k OpenAI bill or a deleted database. Here’s the full list. Hardcoded API keys sitting in your frontend bundle where anyone can view-source and grab them. Supabase tables with Row-Level Security turned off, which means your anon key can read, edit, or delete every row. Service role keys accidentally shipped to the client, bypassing every rule you ever wrote. Zero rate limiting on endpoints that cost real money per call. And admin routes like /admin or /api/delete-user that anyone can hit without logging in because the AI wrote the page but didn’t guard it. Number 2 is the one that got me. Save this post and check your own app before your next deploy. If you want the fast path, I scan every project before I ship. #vibecoding #indiehacker #saas #cybersecurity #buildinpublic​​​​​​​​​​​​​​​​