Nick Perry identifies three security mistakes in AI app development: Supabase disables row-level security by default, leaving tables exposed to any authenticated user; committing .env files with API keys to public GitHub repositories; and prompt-injection attacks when raw user input goes directly to language models. Fix all three before launch.
If you're vibe coding an app with AI, don't make these 3 mistakes that will get you hacked and bankrupted. First, your database. Supabase leaves row-level security off by default, which means it's wide open. Anyone logged in can pull everyone else's data. Go into your dashboard and turn RLS on for every table before you launch. Second, your .env file. If you push this to a public GitHub repo, your API keys are exposed for anyone to grab. And that can bankrupt you within a week. So add it to your gitignore before your first upload. And finally, prompt injection. If you pass user input straight to a model, someone can type instructions that hijack your system prompt. Wrap every user input in clear delimiters so their text can never act as a command. So patch those 3 before you ever go live.
