How to NOT get hacked when vibe coding your app

@district_chronicles

22.2K followers · usually 9.9K views a post

Views

59.6K

Likes

5.2K

Comments

40

Shares

793

Selling · Course / Info

21 day App Launch

https://www.skool.com/21-day-app-launch-4270/about ↗

Why it worked

The video provides practical, actionable advice on common security pitfalls in app development, which is a highly relevant topic for developers. The use of clear numbering and concise explanations makes the information easy to digest and apply.

Summary

The video explains four common security vulnerabilities when developing apps: databases being open by default, uploading .env files to GitHub, lack of rate limiting on AI endpoints, and prompt injection. It provides solutions for each, such as enabling Row Level Security in Supabase, using .gitignore, implementing rate limiting, and properly handling user inputs for AI agents.

Structure

1Intro: How to avoid app hacks
2Vulnerability 1: Open databases
3Vulnerability 2: Uploading .env files
4Vulnerability 3: No rate limiting on AI
5Vulnerability 4: Prompt injection
6Call to action for app development help

Product placement

Original caption

If you don’t want to get hacked, use these steps... These will protect you against 99% of attacks. #vibecoding #apikeys #ratelimiting #cybersecurity #promptinjection

More from @district_chronicles

Their other posts in the index, biggest breakout first.

The video mentions Supabase and GitHub as platforms/tools used in app development. It also discusses AI APIs like OpenAI and Anthropic. The creator's website, helpmebuildanapp.com, is presented as a resource for app development help, and the Skool course "21 day App Launch" is promoted via the bio link.

Call to action

If you need help building or securing your app, go to helpmebuildanapp.com to use the same guide that I did.

On-screen text

.env.Development .env.production .eslintignore eslintrc.js .gitignore Enable RLS before going live "Add rate limiting to any endpoint that touches OpenAI, Anthropic, or any other paid API" "Always wrap user inputs in clear delimiters and never allow user content to reach the system prompt position" helpmebuildanapp.com

Transcript

My episode 16,000 users. Here's how to not get hacked when vibe coding your app. Number one is your database being open by default. Supabase has Row Level Security (RLS) turned off by default for new database tables if created using raw SQL, or it functions as an optional. Meaning any logged in user can query any other user's data with the basic API call. To prevent this, go to your Supabase dashboard, open every table and enable RLS before going live. Number two, uploading .env file to GitHub. Using environment variables is not enough if you push your .env file to a public repo. To make sure you don't get hacked, add your .env to your .gitignore before your first commit. If you've already pushed it, then rotate every key in that file immediately. Number three, no rate limiting on your AI endpoints. If your app has any AI features and someone hits your backend 10,000 times, you will have to pay that bill. This can cost you thousands of dollars in charges. "Add rate limiting to any endpoint that touches OpenAI, Anthropic, or any other paid API." Tell your AI agent to add rate limiting to any endpoint that touches OpenAI, Anthropic, or any other paid API. Number four is prompt injection. Prompt injection is a security vulnerability where deceptive inputs trick an AI into overriding its original system instructions. Attackers use clever inputs designed to override your system prompt. To make sure this never happens, tell your AI agent to always wrap user inputs in clear delimiters and never allow user content to reach the system prompt position. If you need help building or securing your app, go to helpmebuildanapp.com to use the same guide that I did.