Four-AI pipeline exposes critical security flaws in a typical vibe-coded Python app

A developer built a sequential four-model AI review pipeline to audit security in AI-generated code and tested it on a live open-source Flask task-management app of roughly 2,700 lines. The pipeline completed its analysis in about an hour, uncovering several serious vulnerabilities that the original author had unknowingly shipped. Among the findings were hardcoded fallback secret keys and default admin credentials stored in a public repository, allowing anyone with access to the code to forge admin-level authentication tokens. The JWT verification logic was also found to trust the token's own declared signing method, a well-known flaw that can let attackers bypass signature checks entirely. The exercise highlights a growing concern that AI-generated code often appears functional while hiding exploitable security gaps that require an independent, multi-perspective review to surface.