Vibe Coded Apps Get Hacked in the Same 3 Places

Most vibe coded apps get hacked in the same 3 places. A secret key left in the frontend, a login that lets one user open another user's account, and database rules that are switched off. If you're building an app with AI and you can't name the parts of your stack, then your AI is making every decision for you, and you have no way to check any of them. In this video we build one recipe app together, and I explain every part of the stack the moment we need it, the frontend, the backend, login, the database, storage and hosting. At the end I give you one question to ask your AI after every change it makes. Next is the full security checklist before you launch. 0:00 Your AI is making every decision for you 0:36 The frontend 1:08 Never put a secret key in your frontend 1:28 The backend 2:22 Login 3:12 The database 3:42 Storage 4:24 Hosting, development and production 5:05 The one question to ask your AI The question After every change, ask your AI which of these parts did you just change, and who can reach it now? Sources MDN, client side and server side code https://developer.mozilla.org/en-US/d... MDN, what a database is https://developer.mozilla.org/en-US/d... MDN, what an API is https://developer.mozilla.org/en-US/d... Supabase, API keys (publishable key vs secret key) https://supabase.com/docs/guides/api/... Supabase, Row Level Security https://supabase.com/docs/guides/data... Bolt, database and login https://support.bolt.new/cloud/database Bolt Cloud https://support.bolt.new/cloud/bolt-c... Lovable Cloud (built-in backend) https://docs.lovable.dev/integrations... Replit, auth https://docs.replit.com/learn/project... Replit, development and production databases https://docs.replit.com/features/data... The recipe app in this video is a made-up example. Logos belong to their owners, used here for commentary. #techstack #vibecoding #frontend #backend #supabase #lovable #buildwithai