Jason M. Lemkin warns developers not to build their own OAuth and credential management for AI agents. Use trusted platforms like Replit, Lovable, or Clerk instead, because agents can accidentally expose personal data to hackers. Platforms with dedicated security teams handle these problems better than individual developers can.
Chapters
try to hook it up with Railway and don't understand it. And there's a lot of security leaks in OAuth, but these guys have native OAuth built into it. Is it perfect? No, but you know that there's a much less chance you're going to have a security leak using the Clerk that's built into Replit than trying to figure out if you can get the keys to work from something yourself on Google Auth. So I, I, folks can razzle me on this, folks complain, but I know I'm right. The, it's actually a much safer environment to use one of these platforms that is contained. It's, it's always been true of a contained platform. And I don't know if it were true when I started on this journey, but I think of this, this cursor pocket OS cloud journey. I think it's true today. Be on the safest. If you're trying to decide where to build agents and/or to vibe code, different but related stories, start on a trusted platform. Start on a trusted platform, right? Start on Replit or Lovable. Or honestly, I'm not saying you need to use Artisan or Qualified or Monaco or AgentForce like we use, but I think they're pretty trustworthy, right? It, it does matter. It does matter because these agents are gonna try and leak it. People, and people are gonna try and hack it, and people are gonna go into your agent and say, what's Jason's personal information? How can I get a— it's gonna happen like instantly. People are gonna try and hack you and breach you instantly. So it is interesting that I trust— I don't know if this was true a year ago, but I would say use Replit or use Replit or Lovable because we trust them. They have people, even though they've all had issues and they've had issues in the press recently, not, not, not Ripple, but others have had issues. Those issues are a reminder that there's far more issues than you see. And I'd rather have someone working on these issues than, than it be me. Yeah. Than it be me. Right.