Vibe Hacking

View page source, grab the anon key, and query the database directly. Most vibe-coded apps have no Row-Level Security policies, so every table is readable.

How it works

1. 1.Open browser DevTools on any page
2. 2.Search for "supabase" or "firebase" in the source
3. 3.Use the public API key to query the database directly
4. 4.Read, modify, or delete any data without authentication

AI tools generate auth guards in React components but skip server-side checks. Delete the guard in DevTools and access any protected route.

How it works

1. 1.Navigate to a protected page and observe the redirect
2. 2.Open DevTools and modify the auth state in localStorage/context
3. 3.Or call the API endpoint directly without auth headers
4. 4.Access admin panels, user data, and payment information

AI-generated APIs follow predictable naming patterns. Guess /api/users, /api/admin, /api/payments and find unprotected endpoints.

How it works

1. 1.Check network tab for API calls during normal usage
2. 2.Try common endpoint names: /api/users, /api/orders, /api/config
3. 3.Most endpoints return data without authentication
4. 4.Access other users' data by changing ID parameters

Sequential IDs in URLs let anyone access other users' resources. Change /api/users/1 to /api/users/2 and read their profile.

How it works

1. 1.Find any URL or API call with a numeric or predictable ID
2. 2.Increment or decrement the ID
3. 3.Observe that the server returns another user's data
4. 4.Automate to extract all user records

Vibe-coded payment flows often validate on the client. Intercept the request to change the price, skip the payment step, or replay a successful transaction.

How it works

1. 1.Start a checkout flow and intercept the API request
2. 2.Modify the price field or remove payment verification
3. 3.Submit the modified request
4. 4.Receive the product or service without paying

AI hallucinates package names that do not exist. Register that name on npm with malicious code and wait for the developer to install it.

How it works

1. 1.Find AI-suggested packages that do not exist on npm
2. 2.Register the package name with a payload
3. 3.When the developer runs npm install, your code executes
4. 4.Exfiltrate environment variables, secrets, and tokens

Scan before you ship

Run an automated security scan on every deployment. Catch exposed keys, missing auth, and open endpoints before attackers do.

Enable Row-Level Security

If you use Supabase or Firebase, configure RLS policies for every table. Your anon key will always be public. RLS is what protects the data.

Add server-side auth

Never trust client-side auth alone. Validate tokens and permissions on every API endpoint, not just in React components.

Audit your dependencies

Check that every npm package the AI suggested actually exists and is maintained. Remove packages you do not need.

Test your payment flow

Try to bypass your own checkout. Modify prices, skip steps, replay transactions. If you can do it, attackers will.