Appky od AI vyzerajú hotové. Čo v nich chýba?

I received an application for review that a non-programmer dared to submit to the VP. The problem was that the application handled personal data that could be accessed by absolutely anyone. I've been programming for over 15 years, and in this video I'll show you 10 mistakes I regularly see in Vibes. Some are funny,

some are total amateurism, and some are a complete disaster. Well, the last mistake is the cause of all the others. So let's get to it. The first absolute essential when you want to do something commercial is critical security flaws. In the application I reviewed, Convex was used in the background as a backend and

also as a database. The problem was that the login only checked the page that was supposed to be accessible to administrators, but it did not check the queries and mutations that were open to the public. This means that in practice, an attacker only needed to know the path to where these functions were

located and could access names, emails, telephone numbers, or any other sensitive data from the entire database. These so-called endpoints can theoretically be found by a point. This means they would leak all the information. This doesn't just apply to convex, but I've also encountered it in rest apps and other applications. Second mistake from the

same barrel. All you had to do was know a customer's email, insert it in the right place within the URL address, and you would get to their data. This is very common with VIPers, for example, when an integer ID is used, you just need to replace some number and unless there is authorization and

authentication control, you will basically get access to other users' data, which should never happen. This is how applications coded on VIP are hacked terribly often because they do not meet these basic security requirements. In one sentence, authentication is who you are and authorization is what you can do. Both of these things must be controlled by the server.