Securitymaxxing your vibecoded app

@millee.md

2.1K followers · usually 1.9K views a post

Views

14.3K

Likes

948

Comments

3

Shares

136

Selling · SaaS › AI Tool

Claudeseen in 998 videos →

Why it worked

The video provides practical, actionable advice on app security using an AI tool, addressing common pain points for developers and offering clear solutions with visual demonstrations of the AI's capabilities.

Summary

The video explains three security measures for "vibecoded" apps: implementing row-level security to ensure users only access their own data, adding rate limiting to API routes to prevent abuse and unexpected costs, and keeping API keys off the front end to prevent unauthorized access and spending.

Structure

1Intro: Securitymaxxing your app
2Tip 1: Row-level security
3Tip 2: Rate limiting
4Tip 3: Keep keys off the front end
5Conclusion: Implement these for security

Product placement

The video demonstrates using 'Claude Code' (an AI coding assistant) to implement security features like row-level security, rate limiting, and secure API key management in an app.

Call to action

Follow me for part two.

Original caption

Does your app check all 3? #ai #claude #buildinpublic #security #vibecoding

More from @millee.md

Their other posts in the index, biggest breakout first.

On-screen text

Securitymaxxing your vibecoded app Row level security Welcome to Claude Code! cwd: ~/my-app > turn on row level security for every table and write policies so each user can only ever read and write their own rows * Enabling row-level security.. ✓ RLS enabled on all 12 tables ✓ policies written: own rows only * done - nobody can touch anyone else's data > try "audit my auth flow" Rate Limit Reached # of Requests Rate Limiting $10335.23 Feb 8 Feb 9 Feb 10 Feb 11 Feb 12 Feb 13 $139.67 $238.42 $190.43 $189.27 $184.63 $159.65 avg $246.51/day - $10k/day Message Synalbun Dynabun Skins API Key Authentication API-Key X-API-KEY: your-secret-key-here Client App API Welcome to Claude Code! cwd: ~/my-app > add rate limiting to all my API routes, especially anything that costs money per request * Adding rate limits.. ✓ limiter on every route 100 req/min * done - paid endpoints locked down > try "audit my auth flow" Welcome to Claude Code! cwd: ~/my-app > move every key and secret to the server side and confirm nothing sensitive ships in the frontend bundle * Scanning frontend bundle.. ✓ 6 keys moved to server env * done - no secrets exposed on the front end

Transcript

Securitymaxxing your vibecoded app. If you're building an app, here are three things to do before you launch unless you want to get hacked. Number one, roll level security. By default, a lot of V-Cube apps let anybody pull sensitive info straight from your database including other people, which you definitely go on happening. Here's how to fix this. Tell your AI to turn on roll level security for all your tables and write rules so that each user can only ever access their own data. Number two is rate limiting. Right now, there's probably nothing stopping anybody from hitting your N-points thousands of times in a loop. That's how you wake up to a $10,000 API bill overnight. Here's how to fix this. tell your AI to add break limiting to your route, especially on anything that costs money per request. Number three is keeping your keys off the front end. If your AI keys are sitting in the code that runs on somebody's browser, then anybody can find them and start spending your money. Here's how to fix this. Tell your AI to move every key and secure to the server side and confirm nothing sensitive is exposed on the front end. Do these three things before anybody else touches your app and follow me for part two.