Securitymaxxing your vibecoded app pt.3

@millee.md

2.1K followers · usually 1.9K views a post

Views

20.4K

Likes

1.5K

Comments

12

Shares

188

Selling · SaaS › AI Tool

Claude Codeseen in 193 videos →

Why it worked

The video addresses a critical pain point for developers: app security. By breaking down complex vulnerabilities into understandable steps and offering actionable solutions, it provides high value to its target audience, leading to increased engagement and shares.

Summary

This video explains three common security vulnerabilities in apps built with AI: cross-site scripting, file uploads, and payment webhooks. It provides solutions for each, advising developers to tell their AI to sanitize user input, validate file uploads, and verify webhook signatures to prevent attacks.

Structure

1Introduction to security holes in vibecoded apps
2Explaining Cross-Site Scripting (XSS) and its fix
3Explaining File Upload vulnerabilities and their fix
4Explaining Payment Webhook vulnerabilities and their fix
5Call to action to patch these vulnerabilities

Product placement

The video demonstrates security vulnerabilities and solutions using code examples and diagrams, implying the use of an AI coding assistant or framework named 'Claude Code'.

Original caption

Is your app missing any of these? #ai #vibecoding #app #cybersecurity #buildinpublic

More from @millee.md

Their other posts in the index, biggest breakout first.

Call to action

Patch up these three things tonight. Follow me for more AI content @millee.md

On-screen text

Securitymaxxing your vibecoded app pt.3 Cross-Site Scripting (XSS) app.com/comments add a comment: nice app! <script>steal(logins)</script> posted <script>steal(logins)</script> <script>steal(logins)</script> <script>steal(logins)</script> <script>steal(logins)</script> <script>steal(logins)</script> <script>steal(logins)</script> attacker:evil - collecting logins.. Claude Code cwd: ~/my-app > escape and sanitize anything a user submits before it ever gets shown on the page * Sanitizing user content... ✓ output escaping on in all templates ✓ done - user content can't run as code > try "audit my auth flow" ? for shortcuts >> accept edits on Claude Code uploads.app.com invoice.pdf uploaded src-01 online src-02 online src-03 online executing > spawning shell > reading secrets > root access srv-01 offline srv-02 offline srv-03 online SERVER COMPROMISED Claude Code cwd: ~/my-app > check the file type and size on every upload and store files somewhere they can never be executed * Locking down uploads... ✓ uploads validated + stored outside web root ✓ done - uploads can never execute on the server > try "audit my auth flow" ? for shortcuts >> accept edits on Claude Code api.app.com/webhooks ✓ payment_succeeded $29.80 from: stripe.com signature verified payment_succeeded $29.80 from: totally-stripe.biz NO SIGNATURE your app: looks good to me product delivered - order #1337 money received: $0.00 Claude Code cwd: ~/my-app > verify the webhook signature so only real events from Stripe get through * Verifying webhook signatures... ✓ signature check added to the handler ✓ done - fake payment events get rejected > try "audit my auth flow" ? for shortcuts >> accept edits on Claude Code @millee.md

Transcript

If you're vibe coding an app, here are three more security holes and are prompts you probably have prompts need to fix them. First is cross site scripting. If your app shows text that in a user puts in like a comment or a username, somebody could slip in a bit of code that runs in everybody else's browser and steal their logins. To fix this, tell your AI to escape and sanitize anything a user submits before it ever gets shown on the page. Second is file uploads. If people can upload anything to your app and you're not somebody could upload a file on your server and you're not checking and somebody could upload a file that runs code on your server and takes the whole thing over. To fix this, tell your AI to check the file type and size on every upload and store files somewhere where they can never be executed. And third is payment webhooks. If you're monetizing your app and I know you are, your app trusts a message that says a payment went through. So if you're not checking and verifying the message is really from Stripe, somebody could fake it and get your product without ever paying. To fix this, tell your AI to verify the webhook signature so only real events from Stripe get through. If you haven't already, patch up these three things tonight for more AI content. Follow me at millee.md