Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

theregister.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#11

Post by firefoxd »

Lovable is marketed to non developers, so their core users wouldn't understand a security flow if it flashed red. A lot of my non dev friends were posting their cool new apps they built on LinkedIn last year [0]. Several were made on lovable. It's not on their users to understand these flaws

The apps all look the same with a different color palette, and makes for an engaging AI post on LinkedIn. Now they are mostly abandoned, waiting for the subscription to expire... and their personal data to get exposed I guess

[0]: https://idiallo.com/blog/my-non-programmer-friends-built-app...

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#12

Post by s_ting765 »

ch4s3 wrote: post #5

I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access. I'm in…

Ask the LLM to create for you a POC for the vulnerability you have in mind. Last time I did this I had to repeatedly make a promise to the LLM that it was for educational purposes as it assumed this information is "dangerous".

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#13

Post by alfiedotwtf »

firefoxd wrote: post #11

Lovable is marketed to non developers, so their core users wouldn't understand a security flow if it flashed red. A lot of my non dev friends were posting their cool new apps they built on LinkedIn last year [0]. Several were made on lovable. It's not on their users to understand these flaws The apps all look the same with a different color palette, and makes for an engaging AI post on LinkedIn. Now they are mostly a…

Developers with decades of experience still make basic security holes. The general public are screwed once they start hosting their own apps and serving on the Internet.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#16

Post by cube00 »

alfiedotwtf wrote: post #13
firefoxd wrote: post #11

Lovable is marketed to non developers, so their core users wouldn't understand a security flow if it flashed red. A lot of my non dev friends were posting their cool new apps they built on LinkedIn last year [0]. Several were made on lovable. It's not on their users to understand these flaws The apps all look the same with a different color palette, and makes for an engaging AI post on LinkedIn. Now they are mostly a…

Developers with decades of experience still make basic security holes. The general public are screwed once they start hosting their own apps and serving on the Internet.

There's something so innocent about the early days when even Microsoft thought we'd be running Personal Web Servers and hosting our own websites in a peer-to-peer fashion.

Although cynically, in 1996 Microsoft would probably tell you anything you wanted to hear if it got you using Internet Explorer.

The Personal Web Server is ideal for intranets, homes, schools, small business workgroups and anyone who wants to set up a personal Web server.

https://news.microsoft.com/source/1996/10/24/microsoft-annou...

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#18

Post by andersmurphy »

melecas wrote: post #15

Vibe coding democratized shipping without democratizing the accountability. The 18,000 users absorbed the downside of a risk they didn't know they were taking.

With the power of LLMs anyone can make and sell foot guns.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#19

Post by shimman »

melecas wrote: post #15

Vibe coding democratized shipping without democratizing the accountability. The 18,000 users absorbed the downside of a risk they didn't know they were taking.

I don't think you know what democracy means, democracy means that users can reject poorly made apps. If you can't reject or destroy something, it's not a democratic process.

Having someone dump shitty wares onto the public is only democracy if you think being held unaccountable as democratic.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#20

Post by SetTheorist »

shimman wrote: post #19
melecas wrote: post #15

Vibe coding democratized shipping without democratizing the accountability. The 18,000 users absorbed the downside of a risk they didn't know they were taking.

I don't think you know what democracy means, democracy means that users can reject poorly made apps. If you can't reject or destroy something, it's not a democratic process. Having someone dump shitty wares onto the public is only democracy if you think being held unaccountable as democratic.

One of the meanings of the word "democratization" is "the action of making something accessible to everyone", which is clearly the sense meant here.
Post reply on HN