SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

AI-built apps ship with critical security flaws by default, scans reveal

0
·1 views

Security audits of apps built with AI coding tools like Lovable, Bolt, and Replit consistently reveal serious vulnerabilities before developers write a single line of custom code. A scan of 5,600 production apps by Escape.tech found 1,400 with vulnerabilities and over 400 leaked secrets, while a separate audit found 91.5% of 200-plus apps had at least one AI-generated security flaw. Common issues include Supabase tables with row-level security disabled by default, secret API keys exposed in frontend code, and admin access checks enforced only in the browser rather than on the server. These flaws arise because AI coding tools prioritize making demos functional over securing user data. Developers and non-technical founders are advised to audit live apps for exposed keys, verify database permission settings, and use free tools like securityheaders.com to assess their security posture.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer loses 4 days of AI access, spends €200 after overnight automation hits hidden weekly cap

A developer running Claude Code on a flat monthly subscription lost access to the AI tool for four days after an overnight automation loop exhausted his weekly usage limit in just two days. He was unaware that Anthropic had added a weekly cap on top of the monthly one, having never approached either limit during normal use. To meet client deadlines mid-lockout, he purchased additional tokens at full list price, spending €200 over four days at reduced productivity. The incident exposed a blind spot: no tool was warning him in real time how quickly his weekly allowance was being consumed. He subsequently built a usage meter through four iterative attempts to surface that information in plain, actionable language.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AgentATC Uses OpenTelemetry to Expose Silent Failures in Multi-Agent AI Systems

AgentATC is an open-source project built for the 'Agents of SigNoz' Hackathon (WeMakeDevs × SigNoz, July 2026) that addresses a blind spot in AI observability: multi-agent coordination failures that produce no errors or alerts. The system runs a three-agent workflow — Planner, Executor, and Critic — to generate competitive analysis reports, where every inter-agent handoff is recorded as a first-class OpenTelemetry span. A single shared trace ID links all subtasks, preventing fragmented traces and making the full execution history visible in one connected view. To demonstrate the problem, one subtask is deliberately designed to loop endlessly, as the Executor can never satisfy the Critic's rubric, burning LLM tokens silently without triggering any exception or dashboard alert. AgentATC argues that traditional observability tools measure latency, errors, and cost per call, but are not designed to detect coordination breakdowns between agents.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rust library ez-ffmpeg 0.15 offers single-call in-process video frame extraction

Extracting video frames in Rust for machine learning inference has long required either shelling out to FFmpeg via the command line or hand-writing a low-level decode loop spanning dozens of lines. The newly released ez-ffmpeg 0.15 introduces a FrameExtractor API that handles frame extraction in-process with a single function call, returning tightly packed RGB24 bytes ready for use with tensors or ndarray. The library supports flexible sampling strategies, including uniform frame distribution across a video clip, making it well-suited for vision-language model pipelines. A notable issue with many existing approaches — incorrect application of BT.601 color coefficients to HD video, causing subtle color distortion — is also addressed by the library. ez-ffmpeg links against libav through ffmpeg-next and requires FFmpeg 7.1 or later to be installed on the system.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Replicates Anthropic's Vision-Only Pokémon Claim, But Thinking Logs Raise Questions

A developer independently replicated Anthropic's claim that its Claude Fable 5 model can play Pokémon FireRed using only raw screenshots, building a matching harness that reached the first gym badge in 1,785 turns at a cost of $65.40. The experiment confirmed the core result is real, with full logs, frames, and harness code made publicly available for scrutiny. However, after examining the model's thinking chains, the developer found Claude was recalling memorized game knowledge — such as specific trainer dialogue and city objectives — rather than reasoning purely from visual input. The model had written down plot objectives 141 turns before they appeared on screen and identified off-screen trainer details by memory, suggesting its performance relies heavily on training data rather than vision-based reasoning. This raises questions about what 'vision-only' truly means in this context, as Anthropic published no harness code, step count, cost, or definition of 'minimal' alongside its original announcement.

0 comments Read more at DEV Community
AI-built apps ship with critical security flaws by default, scans reveal · ShortSingh