What Is Your AI-Built App Exposing Right Now?

Vibe Coding & Security: Build It, Prove It, Then Lock It Down You can build an app in an afternoon now… But do you know what it’s exposing? In this episode of Arcane Link, I sit down with Brad Bird of 128Bit Studios, a software developer and fractional CTO (chief technology officer) who has been building and deploying software for well over a decade. We’ve been friends for years but hadn’t seen each other in about 10, so this was a chance to look at how building software has changed in that time. This conversation covers vibe coding, AI-generated infrastructure, reviewing code with AI, payment compliance, and the honest conversations Brad has with clients about when security is worth paying for. Brad shares how he takes startups from first idea to MVP (minimum viable product), why he tells clients upfront that a fast AI build is a proof of concept and not a finished product, and how he helped a payments startup achieve PCI DSS (the Payment Card Industry Data Security Standard) in around two months to avoid losing a partner. But this episode isn’t about telling people not to vibe code. It’s about understanding what you’ve built. From AI tools that leave the database open to the internet to the cost of security scanning platforms, Brad explains the gaps people new to building tend to miss… And why what you spend on security should match what’s actually at risk. We also talk about auditing a Terraform module instead of sampling a handful of resources, why Brad prefers small, close-knit teams to corporate life, and his advice for anyone starting out as a developer, whether they’re leaving school or changing careers. Who it’s for: Founders with app ideas, people building software with AI, developers, security professionals, and anyone deciding when their product needs proper security. Subscribe to Arcane Link for more real-world conversations with the people shaping how security actually happens. Want support applying these ideas in your organisation? ADL Consulting helps businesses improve cyber security, risk management, and ISO 27001 readiness through practical, human-centred approaches. 🤝 Let’s Connect! Visit the ADL Website: https://www.adlconsulting.co.uk/ Follow ADL on LinkedIn:   / adl-consulting-ltd   Follow 128Bit Studios on LinkedIn:   / 128bitstudios   🎙️ In this Episode: Follow Ruben Clarke:   / itsrubenclarke   Follow Brad Bird:   / bradiusbirdius   ⏱️ Key Moments 00:00 - Introduction… 01:14 - From freelancing to fractional CTO… 02:53 - Vibe coding and knowing just enough to be dangerous… 05:02 - When AI-built infrastructure exposes your database to the world… 07:17 - Security scanning tools vs prompts and skills in your editor… 09:44 - Proof of concept vs production: managing client expectations… 11:28 - Why nobody hacks a Pokémon trading app (and when security pays)… 13:37 - PCI DSS and the partners you lose without it… 15:23 - From idea to MVP: how Brad partners with startups… 19:32 - Getting PCI DSS ready in two months with Sprinto… 21:22 - Auditing a Terraform module vs sampling 3 of 100 buckets… 24:04 - Building as a squad: partnerships over corporate life… 27:13 - Advice for new developers and career changers… 30:13 - Why you need to understand what’s under the hood…