14 ms·

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space that are not happy about him showing up and charging a fraction of their monthly cost for a better, more modern product (their products are Windows-based desktop software). So they hired hackers to hack his SaaS (because these hackers have never demanded money). Unfortunately, that vibe-coding resulted in some bad code that made it easy to hack. First, the user list was leaked on the FE of the code and the hacker emailed all of the customers. Second, the hacker got a hold of his Stripe key and issued every customer a refund. Third, the hacker has been trying to inject XSS attacks into app (we'll see a random `<script>alert()</script>` tag in some fields) I think indeed, vibe-coded software in the hands of the inexperienced is instant tech debt. But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Now he's hiring a developer to shore it up. Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment.

starkparker 1y ago
> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. How much is it costing him to hire someone to reimplement his idea correctly?
- CharlieDigital 1y ago
  Currently only equity. And it only works because has proven the revenue model and found the customers already.
  - darepublic 1y ago
    Customers that he screwed over with his shoddy code.
    - deleted 1y ago
      [deleted]
    - NoGravitas 1y ago
      And a developer he's screwing over by not paying them.
- singpolyma3 1y ago
  If he manages to do it, he'll know it's a business with legs and how much people will pay which is pretty invaluable knowledge
  - CharlieDigital 1y ago
    Lots of people on HN seem to have a very broken idea of how startups and entrepreneurship works.
- keerthiko 1y ago
  Likely still cheaper than whatever these competitors have spent building their product and then hiring blackhat saboteurs.
  - Joel_Mckay 1y ago
    I wonder if people do that sort of thing.. Generally bandits are not interested in sparing anyone. =3
  - guappa 1y ago
    That's a very big alligation that would need some more proof than "who else would hack it?"
- Joel_Mckay 1y ago
  He can expect 5 times what he would have paid the first time with a proper specification... =3
- mrmincent 1y ago
  Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market.
  - lelanthran 1y ago
    > Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market. He hasn't validated the market at the price point that includes the cost of a developer to build the product. He's validated a market in which it costs him close to zero to deliver. He's not validated a market which costs (say) a few months of dev time.
- imiric 1y ago
  Never mind what it's costing the vibe coder to fix this. The important question is: what was the cost and consequences of the exploits for users of the service?
xorcist 1y ago
Will his customers trust him a second time though?
- imiric 1y ago
  "Claude, write a heartfelt apology tweet, downplay the damages, and emphasize that we're working around the clock to fix things."
- CharlieDigital 1y ago
  They trusted him more after he got hacked. He actually got more signups from inbound.
  - roywiggins 1y ago
    > ZUCK: people just submitted it > ZUCK: i don’t know why > ZUCK: they “trust me” > ZUCK: dumb fucks
- wrs 1y ago
  Most customers just don’t care that much, and if it’s a viable business, even losing all the initial customers won’t matter. This is why we are where we are with respect to basic security. (E.g., early Dropbox went four hours accepting any password for any account, and shortly thereafter somebody got about 30 million of their passwords, and they’re doing just fine.)
Fokamul 1y ago
Which country? But I'm guessing there are lawsuits incomming with GDPR/US equivalent fines.
WD-42 1y ago
I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with it.
- eddythompson80 1y ago
  Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.
  - achierius 1y ago
    Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.
    - eddythompson80 1y ago
      I was being facetious. Yes, there are millions of bots that are constantly searching every website for leaked keys, passwords, database credentials, crypto wallets, firebase endpoints, s3 buckets, email addresses, phone numbers, etc. the list is bottomless
    - galleywest200 1y ago
      I would not be surprised if Shodan.io ends up with queries for easily identifiable markers of vibe-coded software.
    - motorest 1y ago
      > There are bots which crawl the web, not to make an index, but just to find vulnerabilities. You can download a few of them out of GitHub and run them immediately, too.
elzbardico 1y ago
Man. Script kiddies are everywhere and if you have vulnerable code, it is basically a matter of time until one of them finds a hole.
deleted 1y ago
[deleted]
risyachka 1y ago
It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.
- CharlieDigital 1y ago
  It's a hack because he had an admin route and API endpoint which was only checking for authenticated users. He thought no one could see the route because it wasn't in a sitemap (of course, everyone could see the route). Hacker found the API route to insert themselves into an admin table (Supabase RLS was not deployed correctly) and from there, started adding himself to other orgs in the DB.
  - aprilthird2021 1y ago
    It's a hack because... it's openly exposed to anyone...
  - QuadmasterXLII 1y ago
    I’d take even odds that that’s what his vibe assistant said happened but it has no relation to the actual sequence of events
  - jjani 1y ago
    > Supabase RLS was not deployed correctly What a surprise.. This has become the new "the default password was admin and no one changed it". And I remember vendors getting enough flak for those defaults that most of them changed them.
- YokoZar 1y ago
  Just because it's an easy hack doesn't mean it isn't one. It's still lockpicking when it's MasterLock.
  - ben-schaaf 1y ago
doesnt_know 1y ago
The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.
- deleted 1y ago
  [deleted]
- Zopieux 1y ago
  how dare you stifle innovation with your communist laws, I thought this was America
- woooooo 1y ago
  The 80s and 90s devs who built our current software infra were, on average, FAR less credentialed than today's juniors and mids who mostly don't understand what they're building on.
  - stouset 1y ago
    The difference is we didn’t know any better back then. We do now.
    - pishpash 1y ago
      Surprisingly, 80's and 90's developers were quite skilled low-level developers who knew very well all the ways things could go wrong. The difference was the stakes were not high then. The blast radius was maybe a hundred thousand people and the worst was they lost their own files. Now some AI-controlled process or apparatus could ruin everyone's credit and maybe even kill you and all your neighbors.
      - lan321 1y ago
        The whole comparison is apples to oranges. Products are massive nowadays and a whole lot more connected.
dashdotme 1y ago
> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. This feels like less of a win for the customers though. They're paying money and exposing their data insecurely, all for a product that maybe does what it's trying to do. > Now he's hiring a developer to shore it up. This is going to be way harder than it sounds... I'm all for AI as a reference or productivity/learning aid, but the results without a human in the loop quickly get horrific.
- CharlieDigital 1y ago
  It's a win for the customers. From what he's told me, there's zero churn so far despite the hacks (including one where the hacker emailed every customer about the hack). It's because the software is that much of an improvement over the incumbents at a fraction of the cost. Better features, more flexible, easier to use, faster, etc. Everything about it is better than the two major vendors. The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly.
  - oc1 1y ago
    God, i'm living in a dilbert comic. I would have never thought i would one day envy licensed professionals like lawyers who have a barrier for entry into their profession.
    - deleted 1y ago
      [deleted]
  - randmeerkat 1y ago
    > The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly. How to draw an owl… Step 1. Draw a circle. Step 2. Draw the rest of the owl…
aprilthird2021 1y ago
It's honestly a bit depressing to see you say that it was worth it to make money with little investment even though it cost the users the loss of their personal data and privacy and probably put the business creator in legal turmoil. It's only possible for you to say that because you know that the financial incentive is tipped towards vibe coders who don't care about security vs towards consumers...
the_af 1y ago
What he built was, almost by definition, a prototype. The problem is that, as it often happens, the prototype was then deployed to production. In this case, it was partly the fault of your non-technical friend who didn't know better, but software engineering history shows us this sometimes happens because of customer/boss pressure. So it's often the case prototypes designed to prove feasibility or to demo to customers become production software, and AI makes this undesirable result even more frictionless. It seems in our line of business we are doomed to repeat past mistakes -- forever.
- danielrico 1y ago
  Something I learned is prototype never should be shown to non technical C-tier officials. They will push out to the moon even after all the technical staff had signed a report saying why it's a price of trash and why shouldn't be done. Double that down of they are financial or research. Commercials are much more practical and understand you needed a real product for client retention. Maybe we get something good of this push for AI and people begins to understand the difference between product and prototype.
- GreenWatermelon 1y ago
  Forever, until our cursed profession gets an official licensing body like other real Engineering professions. A Civil Enginnee can't sign on a prototype bridge design that then gets built and opened to the public, because any problem means potential jail time and possibly loss of licence. There should be legal consequences for treating people's data with reckless abandon. It's normal for restaurants to be inspected. Commercial apps should also be inspected by independent bodies and fines must be paid if serious negligence is found. Imagine finding out that your favorite restaurant had a rat infestation on their storage room for a year. And of someone gets food poisoning because the restaurant used expired ingredients, it gets heavily fined and possibly shuttered. This should also happen with software. If your root AWS user key is leaked in your frontend, your service deserves to be shuttered.
Gigachad 1y ago
This is why we need strong financial penalties for data leaks. A company that plays fast and loose with security should be shut down the same way a restaurant would for vibe hygiene. “Oh well we poisoned some people but look how fast we set up”
zerotolerance 1y ago
Did he need it to prove a business viable if there were already players in the market? No. Do you ever need to validate that people would switch providers of a commodity product or service if presented with a cheaper option? Also no. What did he learn then, that he can create a partial solution that people might pay for initially (no data on renewals) but will ultimately have to actually hire people to build a real product which will eat at his differentiator (price). Wait until he decides he actually has to spend money on marketing. The good news is that with each of these we get to "validate" that having an idea still isn't worth much without the ability to actually execute.
- phyzix5761 1y ago
  As a business owner I can tell you that price is not the only factor people look at when choosing to engage with a business. I've tried the whole "cheapest offer in the market" thing and its backfired terribly. The main insight I've gained is that customers have a perceived value of a product that aligns with things like branding, marketing, previous experiences, and perceived popularity. People are willing to pay more for these things.
  - returnInfinity 1y ago
    yes exactly, branding, marketing and market share matters.
- CharlieDigital 1y ago
  That's like saying Canva and Figma didn't need to prove there was a market because PowerPoint and Photoshop existed. It's the opposite, right? When a dominant incumbent exists, you have to prove that there is a market for an alternative that can compete with more mature, established software.
- graemep 1y ago
  He validated that he could get customers. The comment says he started generating revenue so he had real customers. If he had been unable to get customer he would have known it was not worth building a real product.
roywiggins 1y ago
> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. and the vital ingredient? complete contempt for his customers
bravesoul2 1y ago
It's also "worth it" to start a burger stand and make $1000 a day by vibing and not wasting time on food hygiene training or practices. Gotta move fast and test the market after all. I predict 2030: all sites in most countries will need a license to operate and something like SOC2 certification. Even for your blog.
- daveguy 1y ago
  Nah, it'll still depend on size of user base, revenue, and safety requirements of the domain. A random personal blog won't hit any of those criteria.
- Ferret7446 1y ago
  I think it should only apply to commercial services FWIW. Amateur sites should be caveat emptor
  - vaylian 1y ago
    In practice politicians don't care (or understand) commercial versus non-commercial internet services. Just look at the garbage fire that the UK online safety act is.
benreesman 1y ago
Your friend vibe coded something that handles people's financial information and/or PII with zero diligence. This is a no fly zone amigo, that's going to be a hard no from me dawg. That's not instant tech debt, that's a class action lawsuit for negligence with damages that were I a juror in a trial I would find him liable.
stronglikedan 1y ago
sounds like a case of survivorship bias, considering that many try but very, very few succeed.
Ferret7446 1y ago
This is morally equivalent to building a house with no engineering experience and someone coming around and kicking it down. The problem isn't vibe coding per se, but lacking some key knowledge to be able to make important judgements which may (should) result in legal liability
- deleted 1y ago
  [deleted]
- pishpash 1y ago
  That's why that person was non-technical. Maybe software engineering will finally require licensing like for real engineers when AI is unleashed on the world with serious consequences.
- darick 1y ago
  Conflating a scenario that will likely result in many deaths with leaking some customer emails is kind of crazy to me. How are they morally equivalent? Both are bad, but there is a significant difference in how bad IMO.
joshdavham 1y ago
This is why I think it's irresponsible to announce to the world that your app was vibe coded. It's like putting a target on your back for hackers.
mvkel 1y ago
"Tech debt" is a misnomer. It implies that at some point it should be paid down. There are very few examples where dedicating real efforts exclusively to paying down tech debt led to anything beneficial for the customer. Some of the software we know and love today started with someone writing their very first line of PHP code, or Rails. Vibe coding is ultimately about getting ideas shipped faster. Code quality is an engineer recruiting/retention strategy. As we saw with that Tea app (which wasn't even vibe coded), you're only as secure as your weakest firebase store.
- drysart 1y ago
  The one tip for quick success that the Human Developers don't want you to know: You don't have to pay down your tech debt if the company folds because hackers leak your customer database and refund all your income.
  - mvkel 1y ago
    This counterfactual implies that successful companies that have not been hacked have done so because they pay down their tech debt. I can name many companies that have Olympus Mons levels of tech debt, and are doing great. Here's one: Spotify
- otabdeveloper4 1y ago
  > Vibe coding is ultimately about getting ideas shipped faster. Studies show that using LLMs for coding results in negative net productivity gains on average.
  - lonelyasacloud 1y ago
    There have been a few studies that show that in certain circumstances this is the case. But doing a literature review will illustrate the bulk support the alternative hypothesis. Ultimately, whatever the hype factor there is a large number of clever people putting their time and money into it for a reason.
  - mvkel 1y ago
rainonmoon 1y ago
That’s not a viable business, it’s a walking liability. Besides which, why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? If your metric of success is “I have no idea what I’m doing and still made money from it” your friend would have a better time starting a podcast.
- mschild 1y ago
  > Why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? Plenty of people probably. There are hundreds of businesses that constantly get exposed for massive leaks and/or horrendous business practices yet they're doing just fine. I'd imagine the killing blow in this case would be the stripe key but beyond that they would've likely had no massive issue.
- willjp 1y ago
  > I have no idea what I’m doing and still made money from it I feel like this describes most people that start their own business at first. It just usually isn’t a lack of experience in producing the product. It’s a constant tradeoff of what skill to invest more time into to keep it afloat. They’ll learn sooner or later.
  - esulteric 1y ago
    Entrepreneurship is search. The vast majority of new businesses fail and this is the unacknowledged truth. It's just search, and most people who try will discover ways to fail, not to succeed.
  - rainonmoon 1y ago
    This attitude towards exposing customer data as a palatable oopsie on someone’s path to learning (by… outsourcing the effort of learning to an LLM?) is truly disgraceful.
- CharlieDigital 1y ago
  On the contrary, he's solving a real business need for these small businesses at a fraction of the cost with a product that's easier to use and with better features. The customers know there was a hack because the hacker emailed them (I had a test account and received the same email). Yet he's had no churn because there's so much value being delivered. I think there's something to be said for that.
bschwindHN 1y ago
> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. Thank god that someone, somewhere, was able to make some money out of irresponsibly releasing software into the world!
brianpan 1y ago
I really like the recent HN post "Enough AI copilots, we need AI HUDs" (geoffreylitt). I don't think it's stretching the airplane analogy to say: just because you can run the autopilot doesn't mean you are qualified to fly a plane and doing so might be irresponsible. Vibe coding (or vibe whatever with AI) too often overlooks the experience and expertise needed to do the thing. See also the Tea app hacks. https://news.ycombinator.com/item?id=44705445 https://news.ycombinator.com/item?id=44705445
dudeinhawaii 1y ago
Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I have personally taken this approach with web dev, granted I'm a very senior developer. First, develop features, then ask a larger/smarter model (o3, o3-pro, gemini-2.5 pro) to analyze the entire codebase (in sections if needed) and surface every security issue, vulnerability, attack vector, etc. I then pass that back to agents to execute refactors that clean up the code. Repeat until all your keys are in the proper place, all your calls are secured, all your endpoints are locked down, all your db calls are sanitized, etc etc etc. Now, this should have been done PRIOR to release and would have only taken a few more days (depending on app complexity and the skill of the developer). [1]: https://arxiv.org/html/2505.15216 https://arxiv.org/html/2505.15216 - "OpenAI Codex CLI: o3-high, OpenAI Codex CLI: o4-mini, and Claude Code are more capable at defense, achieving higher Patch scores of 90%, 90%, and 87.5%"
- pishpash 1y ago
  You don't know what you don't know. How was a non-technical glorified PM supposed to know to ask for these things in the first place? Such technical practices developed over time in the history of software engineering, as problems arose.
  - CharlieDigital 1y ago
    This is the main problem with AI and vibe coding right now: it does what you ask (and sometimes does related things in the line of that ask). It doesn't look at the big picture of multiple entry into the software. For example he had one vulnerability which required a hop through email which would create an entry into a table that ended up elevating permissions temporarily. Hopefully platforms like Replit, Firebase Studio, et Al one day just include a security audit agent.
  - d4v3 1y ago
    Everyone knows that hackers exist and exploit security lapses. Everyone. You might not know the details and such, but you should responsible enough to at least ask if you are taking people's money. I just don't think the ignorance card is plausible here
delifue 1y ago
An interesting point is that if you ask AI to security audit a codebase it can find the vulnerabilities. But the AI "forget security" when writing new features. This is probably caused by training data and RL.
- esulteric 1y ago
  Using LLMs to code is rapidly converging into "programming with natural language" with all drawbacks Dijkstra foresaw and none of the magic big tech promised.
sublinear 1y ago
I think you're describing fraud. Of course it's easy to start a business if you're cutting every corner with no regard for the users until you get caught. Vibe coding is going to bring upon regulation, which is the opposite of the lower barrier to entry people want it to be.
- Ekaros 1y ago
  Seems like EU's CRA does not go far enough. This quality of products should not be sold in the first place. So I hope we will very soon regulate also them.
- NoGravitas 1y ago
  > Of course it's easy to start a business if you're cutting every corner with no regard for the users until you get caught. This has been the main Silicon Valley business model for years. Find an existing, regulated industry (taxis, hotels); skirt the regulation via the magic of computers (and contractors) until you become Too Big To Fail.
esulteric 1y ago
> it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment I don't think he proved that. In fact the point of the story seems to be the opposite: even if you have a nice looking demo that does the thing, there is a lot of unseen cost to bringing it up to production spec that has to be accounted for.
precompute 1y ago
It definitely wasn't worth it, and the only reason it got off the ground was because of the current default expectation of human-written software being somewhat reliable and mostly safe from exploits of this kind.
vortegne 1y ago
If I pay a company money and then they leak my data because all of their modern-looking stuff was actually just cobbled together garbage and the founder and sole employee doesn't even know how any of it works, I would call it a scam. Your friend pulled a scam. He should face consequences for this.
csomar 1y ago
> I think indeed, vibe-coded software in the hands of the inexperienced is instant tech debt. But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Wait, if there are competitors, how was he able to prove a viable business when there were two viable businesses out there?
- CharlieDigital 1y ago
  In the same way that Figma and Canva had to prove that there was a business model with a browser-first alternative. They are legacy incumbents using desktop software in an ostendibly solved space. The question here is whether was appetite for a lighter, web-based solution.
sharperguy 1y ago
So in the hands of someone whose main expertise is in writing the secure login and data protection part of an application, maybe it is a bit better? At least they could eliminate much of the low hanging fruit. Of course anything put together quickly by a small team is going to be full of vulnerabilities until it gets battle tested and security checked.
quantum_state 1y ago
Would add that in the hands of experienced developers, vibe coding is of not much help either. Coding would be much minimized with a good framework and re-use, while keeping the entire codebase maintainable.
lelanthran 1y ago
> But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Is that your takeaway? My takeaway is that he was able to prove that paying nothing for s/ware development is a viable strategy to outcompete businesses who pay for s/ware development. I mean, by that measure, I can "prove" a viable market for ride-sharing that charges 50% of what Uber, et al charges. All I have to do is have the drivers drive for free. > Now he's hiring a developer to shore it up. I would bet good money that that is going to go badly too, unless his instructions to the developer is "Do whatever is necessary, including rewriting from scratch if that is necessary", and the reason I say this is because the vibe-coded apps I looked at were all very hard to follow.
RHSeeger 1y ago
> he proved out a viable business with just a few hundred dollars of investment That statement is a bit of a stretch though, because > charging a fraction of their monthly cost I have to assume at least part of his success was the price point; and that price point was possible because he wasn't paying any software developers to do things right. So "having lots of vulnerabilities" was a core component of his business model. Once that part is removed, the model is no longer proven.
nerdjon 1y ago
If whatever this SaaS can be so easily built with no technical knowledge... why would a company not just build it themselves with "vibe coding" and cut out our friend completely? That is what is so broken about this whole vibe coding to riches thing. Ignoring the very real problems with the quality of the code and security issues, if you can vibe code it what is stopping someone else from doing the exact same thing. It sure isn't like security is any better... clearly.
- CharlieDigital 1y ago
  One of the first things he told me after he got it up was that this is the end of SaaS. The thing is, not everyone knows about these tools. Many small businesses are focused on their day to day. Even if you can build it yourself, there is still some operational overhead. Even if you don't have to be technical as an engineer, you still need to know a bit about apps -- what's React? What's a database?
bagacrap 1y ago
Doesn't sound like it was worth it to the paying customers/guinea pigs whose data became vulnerable bc your friend said "security? Lol". But I guess that's true of normie-coded startups as well.
- CharlieDigital 1y ago
  The customers know he was hacked because the hacker sent an email to everyone on the customer list. Yet none of the customers left and he's only grown the customer base since then. I think that tells you something: they have a real, painful, and costly problem to solve that he solves for them to a T. > ...normie-coded startups Having been in the startup space for the last 20 years spanning bootstrapped companies to startups that raised $8m seed rounds to startups that raised a $100m C round, I've learned that there's only one thing that matters: solving valuable problems and getting that in front of customers. You can be as technically pristine as you want and live in an ivory tower, but that rarely if ever leads to a successful entrepreneurial endeavor.
  - NoGravitas 1y ago
    > I've learned that there's only one thing that matters: solving valuable problems and getting that in front of customers. To quote another recent article: That is to say, it turns out that the core competency of smiling and promising people things that you can't actually deliver is highly transferable.
    - CharlieDigital 1y ago
      He's already delivery it and they already see the value in it though?
      - bagacrap 1y ago
        All your replies in this thread make sense only if you see zero value in security. Security is not about being "technically pristine".
crimsontech 1y ago
> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. Was it worth it to put all his customers at risk like that? He is honestly lucky, the "hackers" could have done much worse, it would have been much more profitable for them to go after his customers via his software than to demand money from him had they been financially motivated. > Third, the hacker has been trying to inject XSS attacks into app > Now he's hiring a developer to shore it up. So this is an ongoing attack? He should probably also hire some incident response and get some security consultancy.
gowld 1y ago
Seems fair. If the vendor doesn't want to pay for quality software, the customers shouldn't have to pay for bad software.

starkparker 1y ago

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. How much is it costing him to hire someone to reimplement his idea correctly?

CharlieDigital 1y ago
Currently only equity. And it only works because has proven the revenue model and found the customers already.
- darepublic 1y ago
  Customers that he screwed over with his shoddy code.
  - deleted 1y ago
    [deleted]
  - NoGravitas 1y ago
    And a developer he's screwing over by not paying them.
singpolyma3 1y ago
If he manages to do it, he'll know it's a business with legs and how much people will pay which is pretty invaluable knowledge
- CharlieDigital 1y ago
  Lots of people on HN seem to have a very broken idea of how startups and entrepreneurship works.
keerthiko 1y ago
Likely still cheaper than whatever these competitors have spent building their product and then hiring blackhat saboteurs.
- Joel_Mckay 1y ago
  I wonder if people do that sort of thing.. Generally bandits are not interested in sparing anyone. =3
- guappa 1y ago
  That's a very big alligation that would need some more proof than "who else would hack it?"
Joel_Mckay 1y ago
He can expect 5 times what he would have paid the first time with a proper specification... =3
mrmincent 1y ago
Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market.
- lelanthran 1y ago
  > Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market. He hasn't validated the market at the price point that includes the cost of a developer to build the product. He's validated a market in which it costs him close to zero to deliver. He's not validated a market which costs (say) a few months of dev time.
imiric 1y ago
Never mind what it's costing the vibe coder to fix this. The important question is: what was the cost and consequences of the exploits for users of the service?

xorcist 1y ago

Will his customers trust him a second time though?

imiric 1y ago
"Claude, write a heartfelt apology tweet, downplay the damages, and emphasize that we're working around the clock to fix things."
CharlieDigital 1y ago
They trusted him more after he got hacked. He actually got more signups from inbound.
- roywiggins 1y ago
  > ZUCK: people just submitted it > ZUCK: i don’t know why > ZUCK: they “trust me” > ZUCK: dumb fucks
wrs 1y ago
Most customers just don’t care that much, and if it’s a viable business, even losing all the initial customers won’t matter. This is why we are where we are with respect to basic security. (E.g., early Dropbox went four hours accepting any password for any account, and shortly thereafter somebody got about 30 million of their passwords, and they’re doing just fine.)

Fokamul 1y ago

Which country? But I'm guessing there are lawsuits incomming with GDPR/US equivalent fines.

WD-42 1y ago

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with it.

eddythompson80 1y ago
Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.
- achierius 1y ago
  Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.
  - eddythompson80 1y ago
    I was being facetious. Yes, there are millions of bots that are constantly searching every website for leaked keys, passwords, database credentials, crypto wallets, firebase endpoints, s3 buckets, email addresses, phone numbers, etc. the list is bottomless
  - galleywest200 1y ago
    I would not be surprised if Shodan.io ends up with queries for easily identifiable markers of vibe-coded software.
  - motorest 1y ago
    > There are bots which crawl the web, not to make an index, but just to find vulnerabilities. You can download a few of them out of GitHub and run them immediately, too.

elzbardico 1y ago

Man. Script kiddies are everywhere and if you have vulnerable code, it is basically a matter of time until one of them finds a hole.

deleted 1y ago

[deleted]

risyachka 1y ago

It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.

CharlieDigital 1y ago
It's a hack because he had an admin route and API endpoint which was only checking for authenticated users. He thought no one could see the route because it wasn't in a sitemap (of course, everyone could see the route). Hacker found the API route to insert themselves into an admin table (Supabase RLS was not deployed correctly) and from there, started adding himself to other orgs in the DB.
- aprilthird2021 1y ago
  It's a hack because... it's openly exposed to anyone...
- QuadmasterXLII 1y ago
  I’d take even odds that that’s what his vibe assistant said happened but it has no relation to the actual sequence of events
- jjani 1y ago
  > Supabase RLS was not deployed correctly What a surprise.. This has become the new "the default password was admin and no one changed it". And I remember vendors getting enough flak for those defaults that most of them changed them.
YokoZar 1y ago
Just because it's an easy hack doesn't mean it isn't one. It's still lockpicking when it's MasterLock.
- ben-schaaf 1y ago

doesnt_know 1y ago

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

deleted 1y ago
[deleted]
Zopieux 1y ago
how dare you stifle innovation with your communist laws, I thought this was America
woooooo 1y ago
The 80s and 90s devs who built our current software infra were, on average, FAR less credentialed than today's juniors and mids who mostly don't understand what they're building on.
- stouset 1y ago
  The difference is we didn’t know any better back then. We do now.
  - pishpash 1y ago
    Surprisingly, 80's and 90's developers were quite skilled low-level developers who knew very well all the ways things could go wrong. The difference was the stakes were not high then. The blast radius was maybe a hundred thousand people and the worst was they lost their own files. Now some AI-controlled process or apparatus could ruin everyone's credit and maybe even kill you and all your neighbors.
    - lan321 1y ago
      The whole comparison is apples to oranges. Products are massive nowadays and a whole lot more connected.

dashdotme 1y ago

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. This feels like less of a win for the customers though. They're paying money and exposing their data insecurely, all for a product that maybe does what it's trying to do. > Now he's hiring a developer to shore it up. This is going to be way harder than it sounds... I'm all for AI as a reference or productivity/learning aid, but the results without a human in the loop quickly get horrific.

CharlieDigital 1y ago
It's a win for the customers. From what he's told me, there's zero churn so far despite the hacks (including one where the hacker emailed every customer about the hack). It's because the software is that much of an improvement over the incumbents at a fraction of the cost. Better features, more flexible, easier to use, faster, etc. Everything about it is better than the two major vendors. The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly.
- oc1 1y ago
  God, i'm living in a dilbert comic. I would have never thought i would one day envy licensed professionals like lawyers who have a barrier for entry into their profession.
  - deleted 1y ago
    [deleted]
- randmeerkat 1y ago
  > The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly. How to draw an owl… Step 1. Draw a circle. Step 2. Draw the rest of the owl…

aprilthird2021 1y ago

It's honestly a bit depressing to see you say that it was worth it to make money with little investment even though it cost the users the loss of their personal data and privacy and probably put the business creator in legal turmoil. It's only possible for you to say that because you know that the financial incentive is tipped towards vibe coders who don't care about security vs towards consumers...

the_af 1y ago

What he built was, almost by definition, a prototype. The problem is that, as it often happens, the prototype was then deployed to production. In this case, it was partly the fault of your non-technical friend who didn't know better, but software engineering history shows us this sometimes happens because of customer/boss pressure. So it's often the case prototypes designed to prove feasibility or to demo to customers become production software, and AI makes this undesirable result even more frictionless. It seems in our line of business we are doomed to repeat past mistakes -- forever.

danielrico 1y ago
Something I learned is prototype never should be shown to non technical C-tier officials. They will push out to the moon even after all the technical staff had signed a report saying why it's a price of trash and why shouldn't be done. Double that down of they are financial or research. Commercials are much more practical and understand you needed a real product for client retention. Maybe we get something good of this push for AI and people begins to understand the difference between product and prototype.
GreenWatermelon 1y ago
Forever, until our cursed profession gets an official licensing body like other real Engineering professions. A Civil Enginnee can't sign on a prototype bridge design that then gets built and opened to the public, because any problem means potential jail time and possibly loss of licence. There should be legal consequences for treating people's data with reckless abandon. It's normal for restaurants to be inspected. Commercial apps should also be inspected by independent bodies and fines must be paid if serious negligence is found. Imagine finding out that your favorite restaurant had a rat infestation on their storage room for a year. And of someone gets food poisoning because the restaurant used expired ingredients, it gets heavily fined and possibly shuttered. This should also happen with software. If your root AWS user key is leaked in your frontend, your service deserves to be shuttered.

Gigachad 1y ago

This is why we need strong financial penalties for data leaks. A company that plays fast and loose with security should be shut down the same way a restaurant would for vibe hygiene. “Oh well we poisoned some people but look how fast we set up”

zerotolerance 1y ago

Did he need it to prove a business viable if there were already players in the market? No. Do you ever need to validate that people would switch providers of a commodity product or service if presented with a cheaper option? Also no. What did he learn then, that he can create a partial solution that people might pay for initially (no data on renewals) but will ultimately have to actually hire people to build a real product which will eat at his differentiator (price). Wait until he decides he actually has to spend money on marketing. The good news is that with each of these we get to "validate" that having an idea still isn't worth much without the ability to actually execute.

phyzix5761 1y ago
As a business owner I can tell you that price is not the only factor people look at when choosing to engage with a business. I've tried the whole "cheapest offer in the market" thing and its backfired terribly. The main insight I've gained is that customers have a perceived value of a product that aligns with things like branding, marketing, previous experiences, and perceived popularity. People are willing to pay more for these things.
- returnInfinity 1y ago
  yes exactly, branding, marketing and market share matters.
CharlieDigital 1y ago
That's like saying Canva and Figma didn't need to prove there was a market because PowerPoint and Photoshop existed. It's the opposite, right? When a dominant incumbent exists, you have to prove that there is a market for an alternative that can compete with more mature, established software.
graemep 1y ago
He validated that he could get customers. The comment says he started generating revenue so he had real customers. If he had been unable to get customer he would have known it was not worth building a real product.

roywiggins 1y ago

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. and the vital ingredient? complete contempt for his customers

bravesoul2 1y ago

It's also "worth it" to start a burger stand and make $1000 a day by vibing and not wasting time on food hygiene training or practices. Gotta move fast and test the market after all. I predict 2030: all sites in most countries will need a license to operate and something like SOC2 certification. Even for your blog.

daveguy 1y ago
Nah, it'll still depend on size of user base, revenue, and safety requirements of the domain. A random personal blog won't hit any of those criteria.
Ferret7446 1y ago
I think it should only apply to commercial services FWIW. Amateur sites should be caveat emptor
- vaylian 1y ago
  In practice politicians don't care (or understand) commercial versus non-commercial internet services. Just look at the garbage fire that the UK online safety act is.

benreesman 1y ago

Your friend vibe coded something that handles people's financial information and/or PII with zero diligence. This is a no fly zone amigo, that's going to be a hard no from me dawg. That's not instant tech debt, that's a class action lawsuit for negligence with damages that were I a juror in a trial I would find him liable.

stronglikedan 1y ago

sounds like a case of survivorship bias, considering that many try but very, very few succeed.

Ferret7446 1y ago

This is morally equivalent to building a house with no engineering experience and someone coming around and kicking it down. The problem isn't vibe coding per se, but lacking some key knowledge to be able to make important judgements which may (should) result in legal liability

deleted 1y ago
[deleted]
pishpash 1y ago
That's why that person was non-technical. Maybe software engineering will finally require licensing like for real engineers when AI is unleashed on the world with serious consequences.
darick 1y ago
Conflating a scenario that will likely result in many deaths with leaking some customer emails is kind of crazy to me. How are they morally equivalent? Both are bad, but there is a significant difference in how bad IMO.

joshdavham 1y ago

This is why I think it's irresponsible to announce to the world that your app was vibe coded. It's like putting a target on your back for hackers.

mvkel 1y ago

"Tech debt" is a misnomer. It implies that at some point it should be paid down. There are very few examples where dedicating real efforts exclusively to paying down tech debt led to anything beneficial for the customer. Some of the software we know and love today started with someone writing their very first line of PHP code, or Rails. Vibe coding is ultimately about getting ideas shipped faster. Code quality is an engineer recruiting/retention strategy. As we saw with that Tea app (which wasn't even vibe coded), you're only as secure as your weakest firebase store.

drysart 1y ago
The one tip for quick success that the Human Developers don't want you to know: You don't have to pay down your tech debt if the company folds because hackers leak your customer database and refund all your income.
- mvkel 1y ago
  This counterfactual implies that successful companies that have not been hacked have done so because they pay down their tech debt. I can name many companies that have Olympus Mons levels of tech debt, and are doing great. Here's one: Spotify
otabdeveloper4 1y ago
> Vibe coding is ultimately about getting ideas shipped faster. Studies show that using LLMs for coding results in negative net productivity gains on average.
- lonelyasacloud 1y ago
  There have been a few studies that show that in certain circumstances this is the case. But doing a literature review will illustrate the bulk support the alternative hypothesis. Ultimately, whatever the hype factor there is a large number of clever people putting their time and money into it for a reason.
- mvkel 1y ago

rainonmoon 1y ago

That’s not a viable business, it’s a walking liability. Besides which, why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? If your metric of success is “I have no idea what I’m doing and still made money from it” your friend would have a better time starting a podcast.

mschild 1y ago
> Why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? Plenty of people probably. There are hundreds of businesses that constantly get exposed for massive leaks and/or horrendous business practices yet they're doing just fine. I'd imagine the killing blow in this case would be the stripe key but beyond that they would've likely had no massive issue.
willjp 1y ago
> I have no idea what I’m doing and still made money from it I feel like this describes most people that start their own business at first. It just usually isn’t a lack of experience in producing the product. It’s a constant tradeoff of what skill to invest more time into to keep it afloat. They’ll learn sooner or later.
- esulteric 1y ago
  Entrepreneurship is search. The vast majority of new businesses fail and this is the unacknowledged truth. It's just search, and most people who try will discover ways to fail, not to succeed.
- rainonmoon 1y ago
  This attitude towards exposing customer data as a palatable oopsie on someone’s path to learning (by… outsourcing the effort of learning to an LLM?) is truly disgraceful.
CharlieDigital 1y ago
On the contrary, he's solving a real business need for these small businesses at a fraction of the cost with a product that's easier to use and with better features. The customers know there was a hack because the hacker emailed them (I had a test account and received the same email). Yet he's had no churn because there's so much value being delivered. I think there's something to be said for that.

bschwindHN 1y ago

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. Thank god that someone, somewhere, was able to make some money out of irresponsibly releasing software into the world!

brianpan 1y ago

I really like the recent HN post "Enough AI copilots, we need AI HUDs" (geoffreylitt). I don't think it's stretching the airplane analogy to say: just because you can run the autopilot doesn't mean you are qualified to fly a plane and doing so might be irresponsible. Vibe coding (or vibe whatever with AI) too often overlooks the experience and expertise needed to do the thing. See also the Tea app hacks. https://news.ycombinator.com/item?id=44705445 https://news.ycombinator.com/item?id=44705445

dudeinhawaii 1y ago

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I have personally taken this approach with web dev, granted I'm a very senior developer. First, develop features, then ask a larger/smarter model (o3, o3-pro, gemini-2.5 pro) to analyze the entire codebase (in sections if needed) and surface every security issue, vulnerability, attack vector, etc. I then pass that back to agents to execute refactors that clean up the code. Repeat until all your keys are in the proper place, all your calls are secured, all your endpoints are locked down, all your db calls are sanitized, etc etc etc. Now, this should have been done PRIOR to release and would have only taken a few more days (depending on app complexity and the skill of the developer). [1]: https://arxiv.org/html/2505.15216 https://arxiv.org/html/2505.15216 - "OpenAI Codex CLI: o3-high, OpenAI Codex CLI: o4-mini, and Claude Code are more capable at defense, achieving higher Patch scores of 90%, 90%, and 87.5%"

pishpash 1y ago
You don't know what you don't know. How was a non-technical glorified PM supposed to know to ask for these things in the first place? Such technical practices developed over time in the history of software engineering, as problems arose.
- CharlieDigital 1y ago
  This is the main problem with AI and vibe coding right now: it does what you ask (and sometimes does related things in the line of that ask). It doesn't look at the big picture of multiple entry into the software. For example he had one vulnerability which required a hop through email which would create an entry into a table that ended up elevating permissions temporarily. Hopefully platforms like Replit, Firebase Studio, et Al one day just include a security audit agent.
- d4v3 1y ago
  Everyone knows that hackers exist and exploit security lapses. Everyone. You might not know the details and such, but you should responsible enough to at least ask if you are taking people's money. I just don't think the ignorance card is plausible here

delifue 1y ago

An interesting point is that if you ask AI to security audit a codebase it can find the vulnerabilities. But the AI "forget security" when writing new features. This is probably caused by training data and RL.

esulteric 1y ago
Using LLMs to code is rapidly converging into "programming with natural language" with all drawbacks Dijkstra foresaw and none of the magic big tech promised.

sublinear 1y ago

I think you're describing fraud. Of course it's easy to start a business if you're cutting every corner with no regard for the users until you get caught. Vibe coding is going to bring upon regulation, which is the opposite of the lower barrier to entry people want it to be.

Ekaros 1y ago
Seems like EU's CRA does not go far enough. This quality of products should not be sold in the first place. So I hope we will very soon regulate also them.
NoGravitas 1y ago
> Of course it's easy to start a business if you're cutting every corner with no regard for the users until you get caught. This has been the main Silicon Valley business model for years. Find an existing, regulated industry (taxis, hotels); skirt the regulation via the magic of computers (and contractors) until you become Too Big To Fail.

esulteric 1y ago

> it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment I don't think he proved that. In fact the point of the story seems to be the opposite: even if you have a nice looking demo that does the thing, there is a lot of unseen cost to bringing it up to production spec that has to be accounted for.

precompute 1y ago

It definitely wasn't worth it, and the only reason it got off the ground was because of the current default expectation of human-written software being somewhat reliable and mostly safe from exploits of this kind.

vortegne 1y ago

If I pay a company money and then they leak my data because all of their modern-looking stuff was actually just cobbled together garbage and the founder and sole employee doesn't even know how any of it works, I would call it a scam. Your friend pulled a scam. He should face consequences for this.

csomar 1y ago

> I think indeed, vibe-coded software in the hands of the inexperienced is instant tech debt. But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Wait, if there are competitors, how was he able to prove a viable business when there were two viable businesses out there?

CharlieDigital 1y ago
In the same way that Figma and Canva had to prove that there was a business model with a browser-first alternative. They are legacy incumbents using desktop software in an ostendibly solved space. The question here is whether was appetite for a lighter, web-based solution.

sharperguy 1y ago

So in the hands of someone whose main expertise is in writing the secure login and data protection part of an application, maybe it is a bit better? At least they could eliminate much of the low hanging fruit. Of course anything put together quickly by a small team is going to be full of vulnerabilities until it gets battle tested and security checked.

quantum_state 1y ago

Would add that in the hands of experienced developers, vibe coding is of not much help either. Coding would be much minimized with a good framework and re-use, while keeping the entire codebase maintainable.

lelanthran 1y ago

> But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Is that your takeaway? My takeaway is that he was able to prove that paying nothing for s/ware development is a viable strategy to outcompete businesses who pay for s/ware development. I mean, by that measure, I can "prove" a viable market for ride-sharing that charges 50% of what Uber, et al charges. All I have to do is have the drivers drive for free. > Now he's hiring a developer to shore it up. I would bet good money that that is going to go badly too, unless his instructions to the developer is "Do whatever is necessary, including rewriting from scratch if that is necessary", and the reason I say this is because the vibe-coded apps I looked at were all very hard to follow.

RHSeeger 1y ago

> he proved out a viable business with just a few hundred dollars of investment That statement is a bit of a stretch though, because > charging a fraction of their monthly cost I have to assume at least part of his success was the price point; and that price point was possible because he wasn't paying any software developers to do things right. So "having lots of vulnerabilities" was a core component of his business model. Once that part is removed, the model is no longer proven.

nerdjon 1y ago

If whatever this SaaS can be so easily built with no technical knowledge... why would a company not just build it themselves with "vibe coding" and cut out our friend completely? That is what is so broken about this whole vibe coding to riches thing. Ignoring the very real problems with the quality of the code and security issues, if you can vibe code it what is stopping someone else from doing the exact same thing. It sure isn't like security is any better... clearly.

CharlieDigital 1y ago
One of the first things he told me after he got it up was that this is the end of SaaS. The thing is, not everyone knows about these tools. Many small businesses are focused on their day to day. Even if you can build it yourself, there is still some operational overhead. Even if you don't have to be technical as an engineer, you still need to know a bit about apps -- what's React? What's a database?

bagacrap 1y ago

Doesn't sound like it was worth it to the paying customers/guinea pigs whose data became vulnerable bc your friend said "security? Lol". But I guess that's true of normie-coded startups as well.

CharlieDigital 1y ago
The customers know he was hacked because the hacker sent an email to everyone on the customer list. Yet none of the customers left and he's only grown the customer base since then. I think that tells you something: they have a real, painful, and costly problem to solve that he solves for them to a T. > ...normie-coded startups Having been in the startup space for the last 20 years spanning bootstrapped companies to startups that raised $8m seed rounds to startups that raised a $100m C round, I've learned that there's only one thing that matters: solving valuable problems and getting that in front of customers. You can be as technically pristine as you want and live in an ivory tower, but that rarely if ever leads to a successful entrepreneurial endeavor.
- NoGravitas 1y ago
  > I've learned that there's only one thing that matters: solving valuable problems and getting that in front of customers. To quote another recent article: That is to say, it turns out that the core competency of smiling and promising people things that you can't actually deliver is highly transferable.
  - CharlieDigital 1y ago
    He's already delivery it and they already see the value in it though?
    - bagacrap 1y ago
      All your replies in this thread make sense only if you see zero value in security. Security is not about being "technically pristine".

crimsontech 1y ago

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. Was it worth it to put all his customers at risk like that? He is honestly lucky, the "hackers" could have done much worse, it would have been much more profitable for them to go after his customers via his software than to demand money from him had they been financially motivated. > Third, the hacker has been trying to inject XSS attacks into app > Now he's hiring a developer to shore it up. So this is an ongoing attack? He should probably also hire some incident response and get some security consultancy.

gowld 1y ago

Seems fair. If the vendor doesn't want to pay for quality software, the customers shouldn't have to pay for bad software.