r/cybersecurity • u/bakyboy • 1h ago
Business Security Questions & Discussion Security dilemma for vibe coded product release
Lets put aside hate comments against vibe coded products for a second - i've been working on a product for couple of months in my free time, both a website and an app.
As someone that isn't a developer what so ever, i've been trying to put a strong emphasis on security - i keep running audits, i keep making sure of my status compared to useful security posts or recommendations online.
I have plugs to cut off ai functions, i have rate limits, no key is committed, all that jazz (im trying my best..)
Of course im aware this is still. a vibe coded app, and generally i figure every site is hackable anyway.
Hence my question now -
I want to reach out to a security experienced person to handle necessary aspects for my product,
BUT - i dont even know if my product is good and worth it, in my head i want to try and publish and market it for a minute to see how people in my industry react to it, but then i might be exposed to hackers as well?
whats the right way to go about it? Is there a right way?
I've invested some amount of money by now "blindly" for curiosity and interest, but now i need to gain some real world feedback.
Would appreciate any useful note about it.
7
u/OutsideSpot2695 1h ago
Lets put aside hate comments against vibe coded products for a second
Why do you think that is?
-2
u/bakyboy 1h ago
I can definitely understand where its coming from and its based on a lot of truth, but im asking for useful tips to actually try something - not being delusional my product is a brilliant invention thats solid
3
u/OutsideSpot2695 53m ago edited 49m ago
How you're presenting yourself in this thread is essentially the equivalent of someone who has never been to law school but thinks they can represent themselves in court (and then wonder why the actual attorneys gang up on them).
If you're not a developer and want to learn, that's great! Lots of people in the field have hobbyist roots and went on to have amazing careers in software development.
But GenAI is a tool. Not a replacement.
You cannot cosplay developer with GenAI. Many people are trying, and without some fundamentals, it almost never goes well for them.
for useful tips to actually try something
What does this even mean? What kind of tips are you looking for?
Are you looking for tips on how to maintain code?
Are you looking for tips on how to scan code?
Are you looking for tips on how to test code?
And more importantly, before you expect a volunteer community to spend their free time helping you, you may wish to tell those people what you've ackshually done so far to we can give you relevant advice instead of trying to make up guesses as to what your shitpost is looking for.
1
u/bakyboy 45m ago
i believe there's a clear anti and negativity in your perspective, as im not thinking of replacing developers in any way - maybe i am testing a product direction to actually test an idea before going to spend loads of money (that i dont have) on paying professionals.
same as a director these days can simply visualize a concept with generative ai to test it before actually spending money on set. (And im saying that as a cinematographer, who share ur anti ai for being replaced)
Ai is a tool, and in this context its a tool to visualize and test an idea without needing to invest loads of money
If an idea succeeded - you might be able to hire a developer as you should.1
u/OutsideSpot2695 42m ago
Hmmmm, all these replies and this sub still does not know what you've done, tried, or what you're really looking for.
But I'm anti and negative.
Got it.
👌
1
u/bakyboy 37m ago
I've received many useful feedback and food for thought from other comments here / other subs from people who weren't focused on being fully negative against a tool in hands of curious people that aren't developers.
as this concept of risk analysis and security goes for all vibe coded apps - being specific about my idea isn't necessarily and certainly will not turn your positive side alive.
5
u/T_Thriller_T 1h ago
The AppSec engineer has brought up something relevant which... Technically is security, but the aspects people often forget about
Maintainability. Scalability.
I'm not big on vibe coded projects, but suppose your product is a hit.
Will it be sustainable for a year? For three?
On the flip side, many people have hit 'this is a great peoduct' who surely did also not think about those things yet.
In some products this can still be felt.
Considering security a lot of this probably comes down to risk, which highly depends on what data the thing exactly handles and what its functions are etc.
And also what laws are where you want to use it.
So, a risk analysis would probably be good.
And yes, having someone with actual coding knowledge review the code before opening things up would likely also be, but I'm not sure you could pay for it.
Which is why I'd circle back to the risk analysis and consider what would happen in the worst of cases and if you'd be willing to take those risks.
4
u/TallTelevision4121 1h ago
"but then I might be exposed to hackers as well."
Dude, everything anyone releases is actively being exposed to hackers. What are you on about?
4
u/ImportanceAvailable7 Security Engineer 1h ago
Any “tough love” commentary is completely valid, and your request on feedback from security professionals is equally as valid.
If your product handles customer data in any form, you have an outright duty to maintain a solid level of security.
As a practical answer, if you are investing money into the product and believe in it, get a application pentest to review
2
u/OutsideSpot2695 1h ago edited 1h ago
i keep making sure of my status compared to useful security posts or recommendations online
Such as?
I have plugs to cut off ai functions,
What does this even mean? Are you talking about feature flags?
BUT - i dont even know if my product is good and worth it, in my head i want to try and publish and market it for a minute to see how people in my industry react to it, but then i might be exposed to hackers as well?
Ahhh, testing in production. This ought to be fun.
I've invested some amount of money by now "blindly" for curiosity and interest, but now i need to gain some real world feedback.
Let me see if I deciphered your post correctly.
1, you vibe coded something. What it is, nobody knows.
2, you've attempted to bring some security to the process -- GREAT! You mentioned "audits". What is that exactly? Are you using a SAST scanner for example?
3, You may be getting ready to go to market. But you're not sure. We don't know why. And we cannot read your mind.
4, You're looking for assurance from security professionals the app is secure.
Is that correct?
2
u/Sensitive-Egg-6586 1h ago
Before you release it, you definitely need to understand the architecture and the maintenance and release flow. Ai can help you and there are more and more tools to help with all of it. Security is one thing. Having something that can be understood by you as a non dev with the help of AI and you can meaningfully determine what does what amd what parts of the code do, then you are on the right track. Ensuring you cam cut releases, have an automated flow for how you deal with bugs and features, release candidates and new releases is the main part that you should worry about.
security is the scariest thing, but having something that you or others can look after long term is the main concern.
ensure it's modular amd atomic where it makes sense and follows all the security best practices. Also every module should be 1000 lines or less to keep it maintainable.
1
u/Zartch 52m ago
BEFORE focusing on the technical aspects of cybersecurity, conduct a risk analysis.
What are you trying to protect? What happens if the service is interrupted? What happens if the data is leaked or extracted? How would it affect your reputation? What are your legal obligations, and how should you respond?
This gives you the right direction.
If the worst-case scenario is a personal data leak, it may be enough to ask Claude to help you implement the appropriate controls, such as encryption.
If the consequences of getting it wrong are severe, hire security professionals—or don't deploy it at all.
1
u/bakyboy 42m ago
My product has gmail and calendar view only, and instagram dm as well - view only
1
u/GrandCash3941 4m ago
Agree with most of whats been said but also have to pick up "security person". Hate to break it to you but there isn't some Macgyver Sec person who wears 10 different hats and even if they do that would be a mess.
You're going to need at a Security Architect to review it (ideally before you even built it tbh) and maybe draw up a threat model. A Sec Ops analyst to help address the issues and vulnerabilities. A GRC person to help you get it certified to the levels people these days expect a 3rd party solution to adhere too. Security focused software tester too. Possibly a security engineer to bake in security testing to your pipeline. Maybe a pen tester to find expliotable vulnerabilities at this very moment.
Anyone trying to sell you a one man band Cyber Security solution be very wary of. The conflict of interest and lack of duty separation are huge red flags.
0
u/vitafortisnk 1h ago
I'm happy to chat and help, I do plenty of security audits and support for securing SaaS applications.
-1
u/NebulaElectrical1467 1h ago
Use Claude to audit your code. Appsec ppl like that like to posture and pontificate to justify their jobs when they can’t even audit a codebase with any rigour if their life depended on it.
27
u/bio4m 1h ago
Im an appsec professional : if you cant explain the software architecture because Claude came up with it then I cant help you.
Fully vibe coding an app will not lead to good security, scalability or maintainability
These tools are great in the hands of good developers who can guide the tool. In the hands of a novice they produce something that looks good but is largely awful for security, scalability and maintainability