Hi everyone my names Ali.
by•
I have a question for all of you specially to those that vibe code and use different Ai tools and are non-technical. How do you know your product is secure and safe? As most Ai tools have their guardrails triggered when they hear the word security and how do you know or find out the code is complete, for instance if you can’t find a human reviewer do you trust the Ai then?
16 views
Replies
Don't ask the AI 'is this secure'. Ask it specific things: list every endpoint and who can call it, where secrets are stored, what happens if a user changes an ID in the URL. Specific questions get real answers instead of a generic checklist. Then fix one thing at a time.
The sloppiest agent code was a summary report that carried a totally confident figure. Tracing the pipeline took an entire day to discover the agent had just hardcoded a placeholder into the query instead of measuring anything.
honest answer is ai cant tell you its secure, it only tells you what it can see. i think if theres real user data or payments a human reviewer is worth paying for once before launch, even a few hours. until then id use a scanner plus the specific questions enio said and not trust a confident yes
Welcome, Ali. Adding to the specific questions advice, which is right: the trick that worked for me is to decide the architecture so that most security questions have a boring answer, and then ask the agent to confirm the boring answer. Three decisions did most of the work in my app. The database rules start from deny everything and a path is opened only when a feature needs it, so the question is never "is this collection protected" but "which three paths are open and why". Anything to do with money is written only by the backend: the app never grants itself credits, it asks and the server decides, because my previous app let the client write its own purchase counters and that is the kind of hole an attacker finds in an afternoon. And every call to the backend has to prove it comes from a real install of the app, not from a script. Once those are in place, a review is a short list you can check yourself even without reading code: show me the rules file, show me who can write this field, show me what rejects a request without the app's token. If the agent cannot point at the line, the answer is no. On the unfinished code habit, the only cure I found is the rule that nothing is done until it has been run, with the output pasted, not described.