Nick Perry explains three security gaps Vibe developers miss. Supabase has row-level security disabled by default, exposing all data to any authenticated user. Raw user input fed to AI models creates prompt injection attacks that can hijack behavior and rack up API costs.
There are 3 major things that'll get you hacked tonight while you're vibe coding an app, and most all developers majorly miss all 3. Okay, so first one is your database. If you spun it up on Supabase, row-level security is off by default, which basically means, yeah, I know, can read everyone's data. So yeah, turn it on. Now this next one, this one will actually cost you money. If you're feeding user input straight into your AI, someone can hijack it. They make your model do whatever they want, and you're paying for every single call. So always wrap it and check it.
