🏴‍☠️this is how your vibecoded app gets hacked... let's hack a website together i'll show you why "trusting client" fallacy can cost you 1000s of dollars thread to learn how to avoid this:

rule #1: treat every client as hostile never trust roles, prices, user ids, flags, or limits coming from the frontend. the client only requests. the server decides.

rule #2: enforce everything server side auth, authorization, validation, rate limits. recalculate sensitive values. check ownership. assume requests can be replayed, modified, or forged.

rule #3: ui restrictions are not security hidden buttons, disabled inputs, and “this won’t be called” assumptions do nothing. if it matters, enforce it on the backend.

Rule #1 should be tattooed on every founder's forehead. I trusted my retail system's frontend validation in 2015. "Nobody would manipulate inventory counts through the browser, right?" Wrong. Lost £14k to a single compromised session before I caught it. Server-side everything. No exceptions. Ever.

wow 🤯 sorry to hear that. an expensive lesson

I found a similar trick on an AI tool. They gave non logged in users a few free uses but the endpoint was unprotected, so I could run it as many times as I wanted via the API

number of apps with these critical vulnerabilities is insane

Server side validation has to be done

non negotiable

Dropped a follow. would love to ask a few questions about an app I’m building if possible🙏🏼

feel free to ask them here if they are not private so others can benefit as well if they are, my dms are open

im going to use rule #2 to tell claude to remove these if vulnerablities exist. thanks

💪

Yeah, I feel like this was engraved to me in college and masters by our professors. So these kind of secure coding practices feels like second nature now.

Was just thinking about how valuable it is for someone to do what you’re doing in this way, thanks for this Amazing lessons Would be cool to see your vibe coding approach to security for non tech users of Claude maybe in the form of a SKILL

very cool, but I think AI will do a better job than humans tbh AI knows client is not safe (at least recent models like opus 4.5 are good at protecting it) and even if a few models might still fail, it’s just a matter of time (months) for vibe coding be safer than any manual senior dev coding just like tesla cars will be safer than regular ones, they are less prone to errors when tired

Good breakdown. So how do you fix this? Send a check to your auth base and check how many credits that user has before firing?

client sends a request to backend to start generation backend checks the database to see if user has an active subscription and enough credits if so, backend starts the generion frontend must be as dumb as possible. just shows stuff on UI and makes requests, not decisions

Legend, thanks for clarifying. Created my first app last week, 99% sure it's set like that.

This is more about basic programming knowledge than vibe coding per se. The backend should always be in control. Basic.

flabbergasting how people miss this. ALWAYS restrict sensitive database actions to backend only. As a rule of thumb, backend methods can only be called form the backend. If you need changes, pass the data from the front end, validate, and let your backend execute.

tbh, i never seen opus 4.5 make an mistake of sending user_subscription_type in json payload might me different model built this, no security modals still giving security prompt to model is better

So happy you are sharing these insights! Thanks:)

ahh hearing this makes me happy 😊

Really good tip. Just followed you! The prompt should include something like: always validate permissions on the server side before executing any service.

Great advice! For my mobile apps I keep all the credit tracking/consuming server side

i learned such thing while i vibecode, and from AI, as once i have started my apps, from the very beginning AIs told me and insisted on using server-side auth, middleware, etc which they did properly (i hope :) ). Still not fininshed apps, but initial security seems decent and i can't imagine launching without properly checking it. Good video and explanation👍

Great post. Thank you. How do we secure our vibe coded apps from this type of hacking?

Don't let amateur ignorant people use AI tools for vibe coding because then they believe they're better than actual professional devs. Or do it, I'm not your mom.

Actually vibe coding prevents this if you use good models it will not do it client side

Client side validation is UX, not security. Every input field is a potential injection point, every form submission an attack vector. Defense starts at the server boundary, not the browser.

Thats why you do verification on Server, not on frontend 😂😂

Great video, a lot of people have these issuws @mindfort agents do this for your app continuously

the backend is what you should validate therefore if someone messes with your frontend code it doesnt matter

That website UI’s deserved to be hacked

Dropped a follow. Security has been one area I’m constantly working on being militant about.

how come every post you make goes viral?

thats why you set a env

Joke's on you, buddy. Try hacking my website I just created. I dare you. I vibe-coded it to be protected online. Ai assures me you wont get access.

This is exactly why programming fundamentals matter before vibe coding

In Game development this is called Authoritative Server.

If anyone thinks vibe coding understands secure coding, you are all sadly mistaken.

This is crazy, it is such basic server security.

Those validations should ALWAYS happen on the server side.