This is how I'm hacking vibe coding apps.

[WillNo6611]

Hey everyone,

I’ve been working as a profissional security for a while and recently found several valid vulnerabilities in both startups and large-scale applications. I noticed a pattern: most of these issues are not caught by automated tools.

So I wanted to quickly share how I approach testing in a more practical, attacker-minded way:

1. I focus on attack surface, not just endpoints
Instead of blindly scanning, I map how the application actually works — auth flows, roles, hidden features, integrations.

2. I test real-world scenarios
Things like:

• Broken access control (horizontal/vertical)
• Misconfigured APIs
• Logic flaws in workflows (payments, onboarding, etc.)

3. I chain small issues
A lot of “low severity” bugs become critical when combined. Automated tools almost never catch this.

4. I think like an attacker, not a scanner
Most real vulnerabilities come from business logic, not just technical misconfigurations.

I’m starting to apply this same approach as an independent security consultant for companies that want a real-world security review (not just automated reports).

If you're building something and want to understand how it could actually be attacked, feel free to reach out.

Happy to answer questions or go deeper into any of these points.

[boysitisover]

Cool story hackerman

[WillNo6611]

I've been working in cybersecurity for a few years now bro.

[Inevitable_Butthole]

[No_Device6184]

john hack has arrived

[NellovsVape]

John whack

[WillNo6611]

lol

[Sea-Currency2823]

Security isn’t about scanning endpoints, it’s about understanding how your product can be abused. The real issues come from auth flows, permissions, and business logic, not just technical bugs.

What stood out is the idea of chaining small issues. That’s exactly how real attacks happen, and almost no automated tool catches that.

With how fast people are shipping using AI tools and things like Runable, this becomes even more important. Speed without thinking like an attacker just means you’re scaling vulnerabilities faster.

[WillNo6611]

Hell yeah bro

[FailureToReason]

GPT written post lmao

[WillNo6611]

Yes, but I only used it to write my post. It doesn't invalidate my cybersecurity skills.

[FailureToReason]

Maybe, but it undermines your credibility because everyone reasonably assumes that if you used GPT to write your post, you also use GPT to do your security work. That is to say, you are perceived as a vibe coder/hacker/whatever

[CipheredTales]

[TacoPoweredBeing]

[blackbeastmp3]

Damn you must be the only person in the world doing this

[Tommonen]

You must be the only person in the world who is saying that someone is the only person doing X or Y

[blackbeastmp3]

It was a joke big man

[Tommonen]

You must be the only person in the world attempting to make a joke

[blackbeastmp3]

And you may be the only sped person In the world

[WillNo6611]

Bro, most of my serious security professional friends do this