Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
1–10 of 39 posts
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#2The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case.
There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#3The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
Yeah, my trust for new open source projects is in the toilet. Hopefully we will eventually start taking security seriously again after the vibe code gold rush.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#4The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
I'm sorry, what?
> Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things
When was this? What world? Did I skip worldlines? Is this a new Universe?
The world I remember is that anybody could write a program and put it on the Internet. Is this not the world you remember?
Further, when those engineers were "trained" ... were there no data breaches before 2022?
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#5I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access.
I'm interested to hear how other people approach this.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#6I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access. I'm in…
Same way you handle preserving any other property you want to preserve while "vibecoding" -- ensure tests capture it, ensure the tests can't be skipped. It really is this simple.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#7The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
I'm sorry, what? > Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things When was this? What world? Did I skip worldlines? Is this a new Universe? The world I remember is that anybody could write a program and put it on the Internet. Is this not the world you remember? Further, when those engineers were "trained" ... were there no dat…
Of course there were. Don't be pedantic. Anybody could write a program and put it on the internet. But to get a reasonably polished version with decent features and an enjoyable enough UX for someone to sign up and even pay money more, it generally took people who kind of knew what they were doing.
Of course shortcuts were taken. They always were and always will be. But don't try to compare shipping software today to even just 3 years ago.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#8The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
Yeah, my trust for new open source projects is in the toilet. Hopefully we will eventually start taking security seriously again after the vibe code gold rush.
> Hopefully we will eventually start taking security seriously again after the vibe code gold rush.
Companies don't take security seriously now (and predating vibe coding)
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#9> One example of this was a malformed authentication function. The AI that vibe-coded the Supabase backend, which uses remote procedure calls, implemented it with flawed access control logic, essentially blocking authenticated users and allowing access to unauthenticated users.
Actually sounds like a typical mistake a human developer would make. Forget a `!` or get confused for a second about whether you want true or false returned, and the logic flips.
The difference is a human is more likely to actually test the output of the change.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#10Earlier quoted context omitted.
I'm sorry, what? > Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things When was this? What world? Did I skip worldlines? Is this a new Universe? The world I remember is that anybody could write a program and put it on the Internet. Is this not the world you remember? Further, when those engineers were "trained" ... were there no dat…
Of course there were. Don't be pedantic. Anybody could write a program and put it on the internet. But to get a reasonably polished version with decent features and an enjoyable enough UX for someone to sign up and even pay money more, it generally took people who kind of knew what they were doing. Of course shortcuts were taken. They always were and always will be. But don't try to compare shipping software today to…
Yes - AI has completely destroyed the set of "Signals" people used to judge quality of much software. They weren't ever 100% accurate, sure, but they were often pretty good heuristics for "level of care", what the devs considered important (or didn't consider important) and similar.
And I mean that as both "end user" software signals, and "library" signals for other devs.
I assume that set of signals will slowly be updated. If one of those ends up being "Any Use of AI At All" is still an open question, depending on if the promised hype actually ends up meeting capability as much as anything.