Security review for vibe-coded websites
The internet is not candyland.
The minute your website goes online, it gets attacked. Not by an enemy. By bots that try every door of every website, all day, every day.
AI helped you build it fast. It did not check who can break in. I do.
- GET/.env404
- GET/.git/config404
- GET/.env.production404
- GET/.env.bak404
- GET/.aws/credentials404
- GET/app/.env404
- GET/api/.env404
- GET/backend/.env404
- GET/credentials.json404
- GET/service-account.json404
- GET/phpinfo.php404
- GET/laravel/.env404
- GET/admin/.env404
- GET/config.php404
- GET/.git-credentials404
- GET/wp-config.php404
- GET/.git/HEAD404
- GET/google-credentials.json404
- GET/.gitlab-ci.yml404
- GET/.env.swp404
- GET/wp-login.php404
- GET/wp-config.php.bak404
- GET/dump.sql404
- GET/database.sql404
- GET/backup.sql404
Nobody is targeting you. Everybody is.
This is what one small website of mine received in 7 days. It is not famous. It was simply online.
- 4,761requests for
.envfiles, where passwords and API keys live - 798requests for
.git, to download the source code - 3,160WordPress and PHP attacks, on a site that runs neither
- 1,197requests for backups, database dumps and cloud keys
Measured on my own server, 5 November 2026 to 12 November 2026. That is 39% of the 25,222 requests it received.
What goes wrong after the vibe
AI writes code that works. Working is not the same as safe. These are the holes I find most often.
- 01
A key left in the open
API keys and tokens sitting in the page source, in a public repository or in an old commit. Bots find them within minutes and spend your money.
- 02
A database anyone can read
Supabase or Firebase left on its default rules. Every user's data is one request away, no password needed.
- 03
Checks only on the screen
The button is hidden but the API still answers. Change a number in the address and read someone else's account.
- 04
Files that should never be served
.env,.git, backups, debug pages. Handed over to whoever asks. You saw the numbers above. - 05
No limits
Login, signup and paid APIs with no rate limit. Passwords get guessed and the bill explodes overnight.
- 06
No way back
No backup that works, no logs, no alert. You hear about the breach from your users.
You store personal data? You are responsible.
An email address is personal data. So is a name, a phone number or an IP address. The day you collect them, the law applies to you, even for a side project.
You must protect it
GDPR article 32 requires security measures that match the risk.
You must report a breach
To the data protection authority within 72 hours (article 33), and to the people affected when the risk for them is high (article 34).
You can be fined
Up to 20 million euros or 4% of worldwide annual turnover (article 83). Small companies get fined too.
"The AI wrote it" is not a defense
The website is yours. So is the liability.
This is not legal advice. It is the reason to take security seriously before something happens.
A human review, by someone who runs servers
One senior engineer reads your site the way an attacker would, then tells you exactly what to fix.
- 1
You write to me
Send the address, what the site does and what data it stores. I answer with a scope, a date and a price agreed before I start.
- 2
I attack, with your permission
You sign a written authorization. I test the live site from the outside, then read the code and the configuration: hosting, database, keys.
- 3
You get a report you can act on
Each finding ranked by risk, with the fix explained in plain words. Paste it to your AI, fix it, and I check again.
What I look at
- Secrets and API keys, in the code and in its history
- Login, sessions and password reset
- Who can read and change whose data
- Database rules and exposure
- File uploads and storage buckets
- Payments and webhooks
- Rate limits and abuse of paid APIs
- HTTP headers, TLS and DNS
- Email spoofing: SPF, DKIM, DMARC
- Dependencies with known vulnerabilities
- Backups, logs and alerts
- Personal data: what you hold and where
Who reviews your site
I am Alexandre Roux, a senior software engineer. I write and review server software in C and Python that faces the internet every day, and I run the infrastructure under it: Linux, Kubernetes, Ansible, Terraform.
I also run my own websites on my own servers. The numbers on this page come from one of them.
Before someone else reviews it for you
Tell me the address of your site, what it does and whether it stores personal data. I answer with a scope and a price.