If you're vibe coding an app, here are three more security holes you might have and a prompts you can use to fix them.

@millee.md

2.1K followers · usually 1.9K views a post

Views

28.7K

Likes

2.1K

Comments

12

Shares

279

Selling · SaaS › AI Tool

Claude Codeseen in 193 videos →

Why it worked

The video provides practical, actionable advice on app security, specifically targeting developers who are "vibecoding" (likely a niche term for building apps quickly or in a specific style). By offering solutions to common vulnerabilities with clear prompts, it appeals to a developer audience looking to improve their product's robustness.

Summary

The video discusses three common security vulnerabilities in "vibecoded" apps: broken access controls, database injection, and exposed admin keys. For each vulnerability, it suggests using AI prompts to implement fixes, such as verifying data ownership, parameterizing queries, and keeping admin keys server-side.

Structure

1Introduction to security holes in vibecoded apps
2Broken access controls and how to fix them
3Database injection and how to fix it
4Exposed admin keys and how to fix them
5Call to action for more AI tips

Product placement

The video features a tool called "Claude Code" which is presented as an AI assistant for coding and security. It is shown in a command-line interface format where the user interacts with the AI to generate code or audit security flows.

Original caption

Check these 3 things before you go live. #aisecurity #buildinpublic #vibecoding #ai

More from @millee.md

Their other posts in the index, biggest breakout first.

Call to action

follow me for more AI tips and tricks

On-screen text

Securitymaxxing your vibecoded app pt.2 Access Control Broken Access Control Claude Code Welcome to Claude Code! cwd: ~ /my-app > check that the logged-in user actually owns the data before handing anything back * Checking ownership on every request... ✓ auth check added to all account routes done - users can only pull up their own account > try "audit my auth flow" ? for shortcuts >> accept edits on SQL Injection: A Detailed Technical Overview username e-mail password Claude Code Welcome to Claude Code! cwd: ~ /my-app > parameterize every query so whatever people type into my forms is treated as data, not code * Parameterizing queries... ✓ raw SQL replaced in 9 queries done - input is treated as data, not code > try "audit my auth flow" ? for shortcuts >> accept edits on ADMIN CONSOLE Health Authority ID This is the ID of the health authority the player is assigned to. Example: "US" Region This is the region of the health authority. Example: "North America" Health Authority This is the health authority. Example: "US" New changes > make sure the frontend only ever uses my public limited key and keep the admin key server side * Auditing keys.. ✓ frontend uses public key only done - admin key lives server-side now > try "audit my auth flow" ? for shortcuts >> accept edits on

Transcript

If you're vibe coding an app, here are three more security holes you might have and a prompts you can use to fix them. The first one is broken access controls. This is when somebody is able to pull up another user's account while logged into their own. To fix this, tell your AI to check that the login user actually owns your data before handing anything back. The second is database injection. This is when somebody is able to access your database by simply typing in a command on any of your apps forms. To fix this, type AI to parameterize queries everywhere so that whatever people type in is treated as data not code. And the third is an pose admin key which basically makes role level security useless from part one. To fix this, Tiger AI to make sure that your front end only ever uses your public limited key and that your app and key is on the server side and follow me for more AI tips and tricks.