SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Audit of 34 vibe-coded apps finds common security and launch-readiness gaps

0
·2 views

A developer ran a free launch-readiness check on 34 apps built with AI tools like Lovable, Base44, Bolt and Cursor, all publicly shared on X between October 20 and 24, 2026. None exposed a secret key or an open database, but every app lacked basic browser security headers and most were missing sitemaps, canonical tags, or social preview tags. Nearly half loaded their first page more slowly than they should, and the grades were 8 B's, 23 C's and 3 D's with no A's. The author stressed that the apps are not bad and that the issues are usually simple settings builders rarely mention. The post includes prompts users can paste into their builders to add the missing configuration.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Researcher Finds High-Severity Rounding Flaw in Tenor Labs' Morpho Midnight Migration Logic

A security researcher participating in a bug bounty for Tenor Labs, a non-custodial protocol extending Morpho Midnight, identified a high-severity rounding vulnerability in its migration callbacks. The flaw stems from a rounding-down calculation that can transfer zero collateral when a tiny debt amount is repaid, leaving new debt unbacked. An attacker could exploit this by making a minimal fill on a migration offer, pushing a borrower's loan-to-value ratio to infinity and enabling liquidation of their existing collateral. The researcher published a Foundry proof of concept demonstrating the math behind the exploit.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why F# Breaks OpenAPI Routes: Sharp Symbols Clash With URL Fragment Rules

A developer building a music theory API found that entering F# as a root note in an OpenAPI interface produced a 404 error. The cause is that the # character marks a URL fragment, so the browser strips everything after it before the request reaches the server. Possible fixes such as percent-encoding, query parameters, or substituting letters were each judged to be awkward or musically misleading. The developer instead adopted German notation, which uses "is" for sharps and "es" for flats, such as Fis, so the URLs stay clean without special characters.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tracking Brand Visibility in Google AI Overviews Without a Paid API

Google AI Overviews now answer many commercial questions before users click any website, prompting businesses to ask whether they appear in these answers. Most AI visibility trackers charge per prompt and location through paid APIs, which is costly for small businesses. The author proposes a manual method: choose 10 to 20 real buying questions, run them weekly while signed out, and record whether an overview appears, whether the business is cited or mentioned, and which competitors are cited. To reduce the tedium of spreadsheets, the author's firm built a free browser-based tracker that stores data locally and computes visibility and share-of-voice scores. The article notes that cited businesses tend to answer target questions early on their pages, keep contact and service details consistent across the web, and receive mentions from other sites.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Details Migrating a Live Speaker Database from One-to-One to Many-to-Many

A developer describes building a speaker roles feature for an event platform, first shipped as a one-to-one relationship before requirements shifted to many-to-many. Existing events were live with integrations and API clients, so changes had to roll out without breaking anything. To keep compatibility, every event got an automatic default role, existing speakers were migrated to it, and the roleId field was made optional in the API. When a question arose about the legacy free-text custom field, production data showed it was sparsely used and too inconsistent to map reliably, so the author proposed an organizer-controlled toggle instead of an automatic migration.

0 comments Read more at DEV Community