Stack, Drawn

How real systems work, and how they break. Hand-drawn explainers on system design + security for vibe-coded apps. Free 5-minute checklist below.

[Stack, Drawn @stackdrawn]

Your Lovable app's database might be readable by anyone.

60-second test on your own app:
1. Open your site, devtools > Network
2. Click a request to https://t.co/6IuMTY9Qge, copy the apikey header
3. Run:

curl "https://t.co/i2Kj0kqLrw*" -H "apikey: KEY"

Rows back = public.

[Stack, Drawn @stackdrawn]

Your Lovable app's database might be readable by anyone.

60-second test on your own app:
1. Open your site, devtools > Network
2. Click a request to https://t.co/6IuMTY9Qge, copy the apikey header
3. Run:

curl "https://t.co/i2Kj0kqLrw*" -H "apikey: KEY"

Rows back = public.

[Stack, Drawn @stackdrawn]

That's 1 of the 15 holes I see in AI-built apps. Others: secret keys in the JS bundle, fake "payment succeeded" webhooks, "make me admin" requests.

Free 5-check list: https://t.co/qsmv5kbHDy

All 15 + a scanner + fix prompts ($19.99): https://t.co/r3dbp9qyPe

[Stack, Drawn @stackdrawn]

Your Lovable app's database might be readable by anyone.

60-second test on your own app:
1. Open your site, devtools > Network
2. Click a request to https://t.co/6IuMTY9Qge, copy the apikey header
3. Run:

curl "https://t.co/i2Kj0kqLrw*" -H "apikey: KEY"

Rows back = public.

[Stack, Drawn @stackdrawn]

X cut off the curl URL in the first post. The full path to add after your project URL:

/rest/v1/TABLE?select=*

TABLE = any table name (profiles, orders, messages...). Your project URL is in the same Network request.

[Stack, Drawn @stackdrawn]

@johnpolacek 230 to 215 in a game you wrote yourself?

Check whether he's found a way to send his own score to the API. Kids find mass assignment faster than any pentester.

[Stack, Drawn @stackdrawn]

@AmirOstowar @Lovable @rive_app This is genuinely fun. Since it takes real payments, one check worth doing on your own store: edit the price in the checkout request in devtools and replay it.

If the order goes through at $0.01, the price is coming from the cart, not the server.

[Stack, Drawn @stackdrawn]

@peripatetictax Two tests that tell you more than an hour of clicking around:

1. Log out, open devtools, call your API routes directly. Anything that answers is public.
2. Make 2 accounts. Copy a record ID from A, open it as B.

Both blocked? You're in better shape than you think.

[Stack, Drawn @stackdrawn]

@fialaerik Ugly v1 that takes money beats pretty v1 that doesn't. Congrats.

One 5-minute check before the next sale: POST to your Stripe webhook route with no signature. If it answers 200 instead of 400, anyone can tell your app "payment succeeded" for free.

[Stack, Drawn @stackdrawn]

@azamsharp 24 hours vs 24 hours isn't the real race. Rerun it after the first security bug report.

Hand-coded: you open the file and fix it in 10 minutes.
Vibe-coded: 3 hours of prompting, and you pray the agent didn't "fix" it by turning RLS off.

[Stack, Drawn @stackdrawn]

@mechakouhai Rule of thumb: if a quiz site wants your email + birthday to tell you which Hogwarts house you are, assume that data sits in a table anyone with devtools can read until proven otherwise.

The quiz is the product. You're the dataset.

[Stack, Drawn @stackdrawn]

@4n6lady Slightly hot take: nobody hand-wrote secure code by default either. They had a senior in code review asking "why is this key in the client?"

Vibe coders didn't skip security. They skipped the senior.

[Stack, Drawn @stackdrawn]

@fahmindot @supabase Fewer than you'd hope. Paste this in the SQL editor before launch:

select tablename from pg_tables where schemaname='public' and rowsecurity=false;

Every row it returns is a table your anon key can probably read.

Free 5-check list: https://t.co/qsmv5kbHDy

[Stack, Drawn @stackdrawn]

@PrajwalTomar_ Point 1 is the one everyone fakes. "Have a privacy policy" usually means a ChatGPT one that lists data you don't collect and skips the processors you do use (Supabase, Stripe, analytics).

I mapped the 10 legal traps I keep seeing in AI-built apps: https://t.co/r3dbp9qyPe

[Stack, Drawn @stackdrawn]

@msnmongare @supabase The two I keep seeing: service_role key shipped in the frontend bundle, and tables with RLS off because "the app worked without it".

Made a free one-command scanner for the leaked-key half:
https://t.co/dymFcUvCFV

[Stack, Drawn @stackdrawn]

@tobiadonadon_ After looks way better. Unpopular take though: for a health app the before/after I'd want to see is the RLS policies, not the gradients.

Health data on a vibe-coded backend is the one combo where a leak isn't a bug report, it's a headline.

[Stack, Drawn @stackdrawn]

@itz_komal01 You forgot the 5th layer of the stack:

a database table with RLS off + the anon key sitting in the JS bundle.

Ships free with every vibe-coded app. No extra prompt needed.

[Stack, Drawn @stackdrawn]

@RoundtableSpace The insult was never about who typed the code. It's about who read it.

Planned + reviewed + tested = engineering.
Prompted + deployed + "looks fine" = vibe coding.

The second one is how a Supabase table full of user emails ends up public.

[Stack, Drawn @stackdrawn]

Free tool if you're shipping an app built with Cursor, Lovable, Bolt or Claude Code.

Checks your project for leaked API keys in 10 seconds:

npx github:stackdrawn/ship-safe-check

Runs locally. Nothing uploaded. MIT.
https://t.co/dymFcUvCFV

[Stack, Drawn @stackdrawn]

@forgebitz Until that exists, the cheapest habit I've seen: give every tool its own API key with a monthly spend cap. When one breaks or leaks, you rotate one key and the damage has a ceiling, instead of hunting through ten apps sharing one key.