Security

Swipe sideways

1. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.→OutWhat it will not doMedium

   Preview this drop

   1. 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
   2. 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
   3. 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
   4. 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.

   No daily video for this drop yet. The in and out lines above are the preview.

2. Coding & Vibe Coding29 Sep 2026 · #25Env Var AuditorPaste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.In.env.example→OutThe fixMedium

   Preview this drop

   1. 0:00 The driftPORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.
   2. 0:08 UnusedNothing in the example is unread. FLY_REGION is the gap, the other way.
   3. 0:16 The live-looking valueSTRIPE_SECRET_KEY's example starts with sk_live_. That prefix does not belong in an example even if they say it is fake.
   4. 0:24 The fixAdd FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.

   No daily video for this drop yet. The in and out lines above are the preview.