ESG Interest Group · Vibe Coders
Rogue AI:
Safeguarding Your Vibe Code
AI writes the code. You own the consequences.
Ethan Seow · Founder, Practical Cyber
· Co-Founder, Centre for AI Leadership (C4AIL)
Rogue AI / ESG
This actually happened
170 apps
One AI app-builder. 303 exposed endpoints. Zero logins required.
CVE-2025-48757 — apps built on Lovable shipped their database unlocked.
Anyone who opened their browser's dev tools could read every user's email, phone number, payment status and API keys.
Disclosed 29 May 2025. Rated 9.3 / 10 — Critical.
Source: NVD / NIST — CVE-2025-48757
Rogue AI / ESG
Ethan Seow
Securing AI adoption — where cybersecurity meets AI.
- ISACA Singapore 2023 Infosec Leader
- TEDx & Black Hat Asia speaker
- Co-founder, Centre for AI Leadership (C4AIL)
- Founder, Practical Cyber
- Trained 500+ across military academies, government agencies & industry
Rogue AI / ESG
PART 1
What you
actually built
You typed prompts. But something real got wired together underneath — and you can't secure what you can't see.
Your app is a house
When you "vibe code", you don't build an app — you wire together rooms. Here's what's really there:
🪟 The shop window
Frontend — what runs in the browser. Everyone on the street can see straight in. Nothing here is secret.
React · HTML · JS
🔑 The master keys
API keys & secrets — the passwords your app uses to talk to other services.
anon key · Stripe · OpenAI
🧑🍳 The staff & rules
Backend / logic — the "if this, then that". In many vibe apps, this room is barely staffed.
Edge Functions · API
🔒 The safe
Database — where all the data lives. Ships unlocked by default.
Supabase · Firebase
🚪 The front-door lock
Auth / login — who's allowed in. Often looks locked, but isn't.
Supabase Auth
🧱 Borrowed fittings
Dependencies — parts the AI orders by name. Sometimes names that don't exist yet.
npm · pip packages
Part 1 / What you built
The one bit of jargon worth knowing
Tech stack
The named set of tools running in each room of your house. When someone asks "what's your stack?", they mean: which tools, in which layer.
Window: React
Safe: Supabase
Building: Vercel
Brain: OpenAI / Claude
Part 1 / What you built
You can't secure
what you can't see.
Vibe code is dangerous not because the AI is evil — but because it built rooms you didn't know exist, and left the doors open. Now let's walk them.
Part 1 / What you built
PART 2
Where it
breaks
Five holes — each one on the same house. Every one has a named, real 2025 incident behind it.
Hole 1 · Exposed secrets
Keys on the window
🔑 Master keys → taped to the shop window
- Your app's keys ship inside the browser. Anyone can right-click → Inspect and read them.
- The Supabase anon key is meant to be public — it's safe only if the safe (database) is locked.
- In the Lovable breach, keys for Google Maps, Gemini and Stripe were sitting in the frontend of real apps.
linkable.site — the $2 app in CVE-2025-48757 · via Matt Palmer
Part 2 / Where it breaks
Hole 2 · No access control CWE-863 · the CVE-2025-48757 root cause
The unlocked safe
🔒 The safe → shipped unlocked (RLS off by default)
- Supabase tables start with Row Level Security OFF. Every red badge here = one wide-open table.
- With the safe unlocked, the "public" key opens every drawer — not just yours.
- The attack: watch the site's network traffic, swap the query to select=*, and the database hands back the whole table.
Source: GitHub Discussion #37688 (Supabase)
"I never logged in. I just asked the safe — and it opened." 500+ users' emails from a single site.
Part 2 / Where it breaks
Hole 3 · Broken authorisation (IDOR)
The wrong door
🚪 The lock → opens for the wrong guest
- Your page loads your record at /account?id=5. What happens if I change it to id=6?
- If the app shows me your data, that's an IDOR — Insecure Direct Object Reference. No hacking tools. Just editing a number in the address bar.
- AI writes this constantly, because it generates code that fetches "the record" — it never models whose record you're allowed to see.
The lock exists. It just never checks who you are before it opens.
Part 2 / Where it breaks
Hole 4 · Injection OWASP LLM01 · Prompt Injection
The shouted command
🧑🍳 The staff → obey any instruction that's shouted at them
- SQL injection (old): type a command into a form field and the database runs it.
- Prompt injection (new): hide instructions in a document, email or webpage. When your AI feature reads it, it obeys the attacker — not you.
- It's worse now because people trust the AI's answer — the "eloquence trap". And an AI agent with tool access runs the payload as your app.
Prompt injection is the new SQL injection — except the attack language is plain English.
Part 2 / Where it breaks
Hole 5 · Supply chain OWASP LLM03 · "slopsquatting"
Poisoned parts
🧱 Borrowed fittings → the AI orders a part that doesn't exist
- AI coding tools hallucinate package names — a study of 576,000 samples found 19.7% of recommended packages weren't real. (USENIX Security 2025)
- Attackers register those fake names with malware. Next person whose AI suggests it installs the payload.
- A researcher registered one hallucinated name, huggingface-cli, as an empty package — 30,000+ downloads in 3 months. Even Alibaba pasted it into their docs.
Part 2 / Where it breaks
And it spreads on its own
The worm in the parts bin
🧱 September 2025 — a self-replicating worm hit the npm supply chain
- Shai-Hulud stole developer credentials, dumped them to a public repo, then used them to infect more packages automatically.
- 500+ packages compromised. This is a national-agency-level alert, not a blog post.
- You don't have to be targeted — you just have to use a poisoned part.
Source: CISA — official alert, 23 Sep 2025
Part 2 / Where it breaks
Notice the pattern
None of these is the AI being "evil". Each one is AI amplifying a weakness you already had.
1 · It finds your holes faster
The bug was always there. AI just removed the effort of finding it — for you and the attacker.
2 · It industrialises the attack
Tailored phishing, mass scanning, self-spreading worms — the skill floor drops to a prompt.
3 · It lowers your guard
People trust "the AI". Confident, fluent, and wrong is the most dangerous combination.
4 · It ships insecure by default
Unlocked databases, exposed keys, no auth checks — the defaults are the threat.
AI's value comes from your data. Its risk comes from your framework — or your lack of one.
Part 2 / Where it breaks
PART 3
Protect
yourself
You don't need to become a security engineer. You need to know the list exists — and run six checks before you ship.
The standard checklists already exist
Two lists of "the known ways apps break". Your AI didn't check its output against either. You can.
OWASP Top 10 — web apps
owasp.org — the 2025 edition
OWASP LLM Top 10 — AI features
genai.owasp.org — Prompt Injection is #1
Part 3 / Protect yourself
Before you ship: six questions
No jargon. Photograph this slide.
- Is any password or key visible in the browser?Right-click → Inspect → search for "key".
- Is your database locked?Supabase RLS / Firebase rules ON — no red "Unrestricted".
- Can you see someone else's data by changing a number in the URL?
- Does your login actually block — or just hide the button?
- What packages did the AI add — are they real, and did you check?
- Does your AI feature obey a hostile message pasted into it?
Part 3 / Protect yourself
The mental model to leave with
98%
Software you own
Deterministic, inspectable, secured by you — the locks, the walls, the rules. This is where safety lives.
2%
The AI model
Swappable, powerful, and not where you put your trust. It writes; it doesn't get to be accountable.
At the org level the grown-up frameworks exist too — NIST AI RMF, Singapore's IMDA Model AI Governance. But it always starts the same way: fix the foundation first, keep an accountable human in the loop.
Part 3 / Protect yourself
Part 4 · Let's look at yours
What did you build?
Shout it out — what did you make, and with which tool? Let's put one on the table and walk it through the six checks together.
STEP 1
Name the rooms — where does your data live, what keys does it hold?
STEP 2
Find the likely hole — an app like that usually leaks here.
STEP 3
Run the six checks — and see what you'd fix on Monday.
We diagnose the type of app — we never touch anyone's live site. That needs written permission.
AI writes the code.
You own the consequences.
1Your app is a house of rooms — you can't secure what you can't see.
2The danger isn't evil AI — it's insecure defaults and blind trust.
3Six checks before you ship. Lock the safe first.
Ethan Seow · C4AIL & Practical Cyber · ethan@practical-cyber.com
