TLDR Tech / InfoSec
Pentest of a 100% vibe-encoded app: complete security analysis of an AI-generated app
A web app built entirely with Claude Opus 4.6 was pentested in grey-box mode with standard user credentials. Critical findings came fast: an LFI via an unfiltered full_path parameter exposed /etc/passwd and opened the door to RCE. An IDOR on /employee/{guid} lets any user pull other employees' emails, roles, and password hashes by harvesting GUIDs from a public leaderboard API. The front-end ran Vite 5.4.10, carrying three known CVEs. AI-generated code ended up skipping input validation, weak access controls, and dependency checks.
Read the full story