Pre-launch audit of a deliberately broken vibe-coded app surfaces 28 issues and fix prompts

·2 views

A developer built a deliberately flawed demo resume app on Next.js, Supabase and Stripe, then ran a pre-launch audit on it using Claude Code. The audit returned 28 findings, including 7 critical, and concluded the app was not ready to launch. The write-up highlights 10 of the most relatable problems, such as a service role key exposed to the browser through a NEXT_PUBLIC variable and database tables with row-level security disabled. For each issue, the report pairs the affected file with an explanation of the risk and a fix prompt intended for use in a Claude Code session. The author notes that the tool used is their own, though its fix prompts work without it, and cites a Veracode study finding AI-generated code introduced vulnerabilities in 45% of test cases.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Walk-Forward Testing Explained: Two Versions With Different Rigor

Walk-forward analysis is widely regarded as a gold-standard method for validating trading strategies, but the term covers two distinct approaches. The classic method, introduced by Robert Pardo in 1992, optimizes parameters on one period, tests them unchanged on the following period, and rolls the window forward, stitching the out-of-sample segments into a composite curve. A stricter variant, purged walk-forward, also removes training data near test boundaries and adds embargo periods to prevent information leakage across folds. The article argues that vendors claiming walk-forward validation should specify which version they used and whether their verdict depends on it. It also recommends using at least five folds across varied regimes, examining performance trends across folds rather than averages, avoiding re-tuning on out-of-sample data, and following walk-forward testing with forward paper trading.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping AI Products Online During Model Provider Outages With Gateways and Fallbacks

A guide published by Control Plane, a cloud platform vendor, recommends placing an OpenAI-compatible gateway in front of all model calls to keep AI products running when a provider fails. It advises configuring fallback chains that move from the same model in another region to an equivalent model from a different provider, then to a self-hosted open-weight model. The article lists common failure modes, including full outages, elevated error rates, rate limits, latency spikes, regional capacity limits, broken streams, and model deprecations. It also recommends running the gateway and agent services across multiple regions so the resilience layer does not become a single point of failure. Testing with blocked providers and injected errors is suggested to measure fallback speed and output quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Secrets Distribute Credentials but Do Not Provide Key Custody

A Kubernetes Secret is well suited to delivering sensitive configuration to workloads, but it is not designed to answer security questions such as identity, authorization, or key custody. Problems arise when one Secret ends up representing identity, enrollment state, rotation, and tenant context all at once, making failures hard to diagnose. The article argues for separating distribution, private-key custody, workload identity, and authorization, so that a private key is never exported to the caller. It also describes a candidate enrollment contract that requires enrolled workload credentials to live in encrypted, CRD-backed custody with a non-exporting signing interface, while forbidding Secret volumes and similar injection methods. The author notes that this contract is not yet qualified and that migration work remains open.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running Apps Across Regions: Routing, Databases, and Failover for Stateful Workloads

The guide explains that multi-region deployments rely on deploying the same stateless services from one definition to every region, with a health-checked global routing layer sending users to the nearest healthy region. Each database needs its own data topology, such as a single primary with replicas, multi-primary, or distributed SQL, chosen according to tolerance for write latency and data loss. Stateless services fail over through routing changes, whereas databases require promotion steps that must be designed and tested in advance. Automatic failover depends on quorum, so two locations tolerate no location loss, three tolerate one, and five tolerate two. The article notes it is published by Control Plane, which offers a multi-location platform and database templates.

0 comments Read more at DEV Community