Mohamed Qasas

Building ShipShield: security checks for AI-built apps 🛡️ Lovable · Bolt · Replit · Cursor. Ship fast, don't leak.

[Mohamed Qasas @achieve_wealth_]

if you want to check your own app before a user does, the free self-check is 10 quick yes/no checks, no signup: https://t.co/Gb6fjFV8rD

code SHIELD takes $10 off the kit till Sunday

[Mohamed Qasas @achieve_wealth_]

day 5 of launching a security checklist for vibe coded apps.

followers went 19 to 23. still 0 sales.

my 3 posts today did about 20 views each lol.

but the best convo I had all day was in a reply under someone else's post. a guy told me he once let anyone give themselves Pro because the app trusted a client side call.

so tomorrow I'm talking more and posting less.

what's the dumbest bug you've shipped that a user found before you did?

[Mohamed Qasas @achieve_wealth_]

@its_m1ko @Lovable nice, will have a look at the site in the next day and send you what I see. only the public stuff, nothing invasive

[Mohamed Qasas @achieve_wealth_]

@KestrovKits @supabase @paraga yeah good add. per user limits are the one people skip because everything "works" in testing. one runaway loop on a logged in session and the bill is the first alert you get

[Mohamed Qasas @achieve_wealth_]

study is by Crissy Field with Handelsblatt, worth a read if you're on Supabase.

quick test: private window, logged out, F12, Network tab, look for the https://t.co/TEsmPzMqFa calls. if rows come back without a login, that table is public.

that plus the other go-live checks, free, no signup: https://t.co/dtqmNAj6mL

code SHIELD takes $10 off the kit till Sunday

[Mohamed Qasas @achieve_wealth_]

german researchers just scanned 159,041 Lovable apps.

on 7,403 sites they could read email addresses with no login. plus 1,000+ passport records and over 200k chat messages.

no hacking. same key the page hands every visitor. RLS basically off.

the login screen was just decoration.

have you ever opened your own app logged out to see what loads?

[Mohamed Qasas @achieve_wealth_]

quick test: open an incognito window, paste https://t.co/aH8r0JF8li (or /dashboard, /settings). if anything loads besides a login page, the check is only in the UI.

that one plus the other go-live checks, free, no signup: https://t.co/Ikyvsd2crw

code SHIELD takes $10 off the kit till Sunday

[Mohamed Qasas @achieve_wealth_]

the AI built me a really nice admin page.

it did not build the part where you have to be an admin.

hiding the button in the menu isn't a lock. the route still loads for whoever types it.

honest question, have you ever opened your own /admin in a logged out tab?

[Mohamed Qasas @achieve_wealth_]

@Divinedigitts oh my bad, good that there's no API to leak then. still worth checking what the extension stores locally though.

[Mohamed Qasas @achieve_wealth_]

@dsflowmind nice, that's a clean trick. mapping back after is the part most people forget.

[Mohamed Qasas @achieve_wealth_]

@FernanHickman ha yeah that one bites a lot of people. by hand for now, honestly. CI check is on my list. how are you doing it?

[Mohamed Qasas @achieve_wealth_]

minified doesn't mean hidden.

open your live app, F12, then Ctrl+Shift+F. search service_role, sk_ and secret.

that search runs over every JS file your visitors download too.

which would hurt more to find in there, your Supabase service_role key or your OpenAI key?

[Mohamed Qasas @achieve_wealth_]

the anon key and pk_ keys are fine to be public btw. the other two are not.

full list of what to check before launch, free, no signup: https://t.co/lYF6aa9399

code SHIELD takes $10 off the kit till Sunday

[Mohamed Qasas @achieve_wealth_]

@ronaldships the "your agent knows how your app works but you don't" line is so real. random offer, i do free 10 min go-live checks on what's publicly visible for indie apps. want one for seerepo?

[Mohamed Qasas @achieve_wealth_]

@LBoksmati saw eduviasphere, an e-learning platform on replit is a big build. once students start signing up the login and data side matters a lot. i do a free 10 min check of what's publicly visible on apps like this, want me to run one?

[Mohamed Qasas @achieve_wealth_]

@goldenagesurfer million dollar homepage 2026 is honestly a funny idea. if people start paying for spots it's worth making sure nothing weird is exposed. i do a free 10 min check of what's publicly visible on vibe coded sites, want me to look at yours?

[Mohamed Qasas @achieve_wealth_]

@MoneyCoachAI hey, congrats on getting money coach ai into the app stores. since it holds people's income and spending data i figured i'd ask. i do a free 10 min check of what's publicly visible on lovable apps, just tell you what i see. want me to take a look?

[Mohamed Qasas @achieve_wealth_]

@JEFFREYJRCOO hey, saw the WWE Trust site you built with lovable. the free estimate setup is smart for a service biz. i do quick go-live security checks on lovable sites, just looking at what's publicly visible like forms and keys. takes me about 10 min, free. want me to run one on yours?