South African coffee franchise exposes company and private data in vibe-coded web application

SauRoNZA said:
The vibe coding isn’t really the issue here
Click to expand...
Pretty sure it is. Hosting was secondary and made it available to all and sundry.
Put simply, the leak wasn't exposed because of a server misconfiguration or a breach of the hosting provider. It was discovered because the app's frontend source held sensitive data that a quick page inspection revealed.

Hosting internally would still have leaked data.
 
Last edited:
I find this a little odd because Claude constantly nags about security. To get it to expose sensitive data on a public url you would likely need to repeatedly tell it to explicitly ignore security concerns. Just my 2c.
 
SauRoNZA said:
I mean even just asking the AI how to make this more secure would probably have done a hell of a long way.
Click to expand...
This. No need to even ask it to Red team/Blue team it. Just point out basic security vulnerabilities would have gone a long way.
 
SauRoNZA said:
I mean even just asking the AI how to make this more secure would probably have done a hell of a long way.
Click to expand...
Makes me wonder if any of those ‘direct reports’ he unleashed Claude Code on have actual dev, security or deployment experience.

Don’t even get me started on the sharing of screens in photos without obfuscating the urls
 
now05ster said:
This. No need to even ask it to Red team/Blue team it. Just point out basic security vulnerabilities would have gone a long way.
Click to expand...
Not even remotely accurate.

Site should never have loaded data prior to authentication. This is classic vibe coding garbage by clueless farkwhit for dumber than rotting cabbage reasons.

Quit playing the "bad use of LLM" card. LLMs produce garbage because they do not reason or assess. They spew out the noise they were trained on. If you don't get this, you do not know what LLMs are.
 
rustypup said:
Quit playing the "bad use of LLM" card. LLMs produce garbage because they do not reason or assess. They spew out the noise they were trained on. If you don't get this, you do not know what LLMs are.
Click to expand...
Oh, it's angry pup to save the thread LOL. I have to ask why you're so angry half the time, it's not like it enhances your point.

Most half decent LLMs push out half decent code. They're a tool like any other. If you're not using an LLM for coding you'll be going the way of the dinosaur, not that I think that's a good thing. This is not an absolutes game (LLM BAD, PEOPLE GOOD), you still need people in the equation who understand code and good security practice to prompt, verify and test, but saying you can't trust an LLM to produce good code is pure ignorance.
 
rustypup said:
Not even remotely accurate.

Site should never have loaded data prior to authentication. This is classic vibe coding garbage by clueless farkwhit for dumber than rotting cabbage reasons.

Quit playing the "bad use of LLM" card. LLMs produce garbage because they do not reason or assess. They spew out the noise they were trained on. If you don't get this, you do not know what LLMs are.
Click to expand...
If you like to do vibe coding you might as well get into vibe lawyering as well to defend your case.

Sure i know it makes things easy to ask LLMs to type for you, but i hope you know and understand what that AI is typing on your behalf and you review whatever it has done, and not by asking it in it's own words.
 
AfricanTech said:
Makes me wonder if any of those ‘direct reports’ he unleashed Claude Code on have actual dev, security or deployment experience.

Don’t even get me started on the sharing of screens in photos without obfuscating the urls
Click to expand...

I mean obfuscating URL’s is security by obscurity and shouldn’t even matter.

But going by the average exec team my guess would be a hard no. While the real techies are told it’s too expensive for them to use.
 
FiestaST said:
https://twitter.com/x/status/2110952063433592989
Click to expand...

It’s not wrong in the sense that better means more functionally appropriate by subject matter experts that never could have done it before and couldn’t justify an engineer to look at it or even couldn’t explain it to them.

From a use case and practicality point of view it’s out of this world.

It’s just that generally these things don’t land in a production state and really should be considered prototyping that can then go to the real engineering team if it’s selected for production use.

Like I said before the failure point is really the deployment stage, not the fact it was vibe coded to start with.
 
rustypup said:
Not even remotely accurate.

Site should never have loaded data prior to authentication. This is classic vibe coding garbage by clueless farkwhit for dumber than rotting cabbage reasons.

Quit playing the "bad use of LLM" card. LLMs produce garbage because they do not reason or assess. They spew out the noise they were trained on. If you don't get this, you do not know what LLMs are.
Click to expand...
30% of Windows code is LLM lol and it’s only going to grow.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X