932: Vibe Coding’s Huge Problem

Wes and Scott talk about the dangers of vibe coding when it comes to authentication and access control. They share real-world examples of security fails, discuss how to avoid client-side-only checks, and offer practical tips for protecting sensitive user data in your apps. Show Notes 00:00 Welcome to Syntax! We build the world’s most painful CAPTCHAs (Kitboga scammers) 02:08 Brought to you by Sentry.io 02:33 Wes’ vibe coding experience Wes’ app 04:38 The Tea app disaster Tea app 07:45 Don’t vibe code access control Better Auth with Better Auth 09:38 Let in, don’t lock down 11:23 Server vs. client-side code 13:46 Visualize access control 15:30 Automate tests 17:00 Sick Picks + Shameless Plugs Sick Picks Scott: A City on Mars Wes: Hotel Collection Essential Oils Shameless Plugs Syntax YouTube Channel Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Wes Bos?

  Welcome to Syntax. Today, we're talking about vibe coding. It has a serious problem, specifically around... I think vibe coding has a lot of problems, and I'm saying that as somebody who likes to vibe code as much as the next guy.

• 0:14Scott Tolinski?

  I'm saying vibe coding has no problems and is excellent, just so that the comments are balanced on this one.

• 0:20Wes Bos?

  There we go. Okay. So, there's obviously a lot of problems, but today, I want to specifically talk about something that has hit me and something that hit a major website, that T app. And that is authentication and access control on vibe-coded things. And I think that we are about to see a wave of security issues pop up. And I want to talk today about what those problems are and how you, the brain-dead vibe coder, can solve these things, or how I think you should be actually approaching access control in apps that you're building. So, what's up? My name is Wes Boss. I am the winner of the Kitaboga Code Jam. If you didn't catch it yet, we all built captchas.

• 1:05Wes Bos?

  And we have a video on the Syntax YouTube channel about the worst captchas you could ever build. Kitaboga is a YouTuber who scams scammers. And what he does is he has this VM, and he just has these hilarious captchas. And we all built a couple captchas for it. And mine was the winner because it was the best voted by him, Kitaboga. Oh, Kitboga. Why do I say Kit-a-boga? There's no A in there.

• 1:32Scott Tolinski?

  I don't know why. Yeah. That's always fun. Yeah. If you haven't seen that video, we'll link it up. That is absolutely a video you need to watch.

• 1:42Wes Bos?

  Scott's was the funniest thing ever, which is...

• 1:44Scott Tolinski?

  I think Wes's was the funniest thing ever.

• 1:47Wes Bos?

  Mine was like funny haha to watch, but Scott did one where you had to sing a note in order to pass the captcha. He's just laughing even thinking.

• 1:58Scott Tolinski?

  Uh, I, you guys gotta watch this. This was like the most fun video I think we've ever released. So if you haven't seen it by now, now's a great time to put it on. And if you want to see all of the errors in your application, you'll want to check out Sentry at sentry.io/syntax. You don't want a production application out there that, well, you have no visibility into in case something is blowing up and you might not even know it. So head on over to sentry.io/syntax. Again, we've been using this tool for a long time and it totally rules. All right.

• 2:33Wes Bos?

  All right, let's talk real quick. So this was an app that it's Sentry Hack Week right now and we're building some apps and I'm building this like LED grid that you can control over the web. And I needed some very basic auth, basically where I was just gonna throw a cookie in my own browser and I'm checking for that cookie and a specific value on request, right? At the very most basic auth that you can get. I added that in and whatnot and then I just like typed into cursor, like, go ahead and protect these routes with it. And it started adding the auth client side. Like it was checking for the auth authentication client side. And then it was also adding an error message that says,

• 3:18Wes Bos?

  you don't have access to this. Add a cookie with this following value in order to have access to it. That's literally, literally telling the person how to get access to it.

• 3:30Scott Tolinski?

  Hey Wes, have you ever considered this is the future of apps? And AI never makes any mistakes and is perfect. And the fact that it's suggesting this to you means that you need to upgrade your brain matter.

• 3:42Wes Bos?

  Yeah.

• 3:43Scott Tolinski?

  Yeah. Have you considered that?

• 3:45Wes Bos?

  No, I have not considered that. But honestly, the fact that I caught it. So what it was doing is it created an auth. ts file and it was putting the client code and the server code in the same file. And sometimes in apps you can do that and it gets tree shaken. But like literally it was adding that into the same file and it was only doing the check. Client side. So before you click a button, it would check if you had the cookie there client entirely client side. It wasn't protecting the route at all. And the fact that I caught that and I said, are you checking the auth client side? This is, you're absolutely right, which drives me nuts. Um, I shouldn't be checking the admin auth client side. That would be completely insecure, which, which it is, right?

• 4:28Wes Bos?

  And, and those types of things like, like luckily I know what I'm doing and I had caught that. And it wasn't a high stakes app, but I don't think that that's the case with, with a lot of them. So another example is there's this app called the T app, which what was it was like an app where? People could figure out if they're dating the same person. Was that the whole idea?

• 4:48Scott Tolinski?

  It was a dating app, but it, yeah, that, ah, man. A part of the application that I think is kind of shocking in all of this is that they had women upload their drivers licenses. And like the, the fact that this would have been taken in a way that was so insecure. Or, uh, you, you can explain how it was insecure, but when you're dealing with such secure. Data and information being so careless.

• 5:22Wes Bos?

  You ever heard of it?

• 5:24Scott Tolinski?

  Is just shocking and mind blowing to me. And this person should, I, I, I don't know what the legal consequences, but this person. The people responsible for this, this is like negligence. They should face legal consequences in my mind.

• 5:38Wes Bos?

  Exactly. So what was happening was that they're, they're having women upload the driver's license or something else in order to, to be validated. Right? And then they were storing those photos in a, a Firebase bucket, right? Just as like an asset. However, they also had an endpoint that could pull all of those assets. And then it basically, it was just a wide open endpoint. I'm, I'm showing it right now on the screen. It's still in Firebase. These, these attachments are no longer accessible. So I've heard. And people could just scrape this API endpoint.

• 6:17Wes Bos?

  And then, and then download every single asset that was, was available. And these were private assets not to be accessed by the general public. Right? So that's, that's a, that's a major security issue, having people's sensitive documentation. Even storing something that sensitive requires like, like security officers and all of the stuff. And, and I do believe that this T app was primarily vibe coded. And you're hearing these stories and I believe you're going to hear a lot more of these stories of these awful security instances where either you go too fast and you don't notice it, or you don't actually know what you're doing and you build an application that is insecure. And I think we're gonna, we're gonna see a lot of this.

• 6:59Wes Bos?

  So we're here today just to run through a couple of things of like, like what can you do? If you are vibe coding this type of stuff? Or also just like, if you're building an app that has access control in it, it's probably one of the most important pieces to your, to your app. Like authentication alone, you can, you can use a package like Better Auth or, or whatever. You can use a third party thing to, to actually put authentication into it. But when it comes to, once that person is signed in and locking down access to your data, API endpoints and post requests and whatnot, making sure that people who should not be able to access specific data, don't have access to it.

• 7:44Wes Bos?

  That's very important. So here are our tips. First, don't vibe code access control. It's really not that hard. It's not. Access control can get, can get complex in like you having to manage who has access to what. But being able to say yes or no, does somebody have access to this thing? And generally you can break it down to, do you have access to it? Yes or no? Or you can bring it, break it down even into, to crud. Can they, can they create these things but not read them? Can they read them but not create them? Can they delete them? Can they, can they read their own? These are common things that are built into a lot of, of access control apps out there.

• 8:27Wes Bos?

  If you're using some sort of CMS backend, or you yourself can build a very simple access control where you check off boxes for each of them.

• 8:37Scott Tolinski?

  Yeah, and it is, like you mentioned, usually a matter of can edit all or can edit own? Or, you know, can edit some very specific ones based on some other criteria. But 99% of the time, it's like, can edit own or can edit all? Can view own, can view all, can delete own, can, you know, can create? Those types of things, there is not that much there.

• 9:03Wes Bos?

  No, and it's, it's mostly if statements at the, at the end of the day. And I believe Betteroff, they're gonna be putting out, like, wherever we're asking, like, we did an episode on Betteroff and we're like, I would love a UI for actually managing access control. And, and a lot of people said, that's what the paid, their paid product is going to be.

• 9:21Scott Tolinski?

  Yeah. I would like that, too. I would pay for that. I always liked Drupal's permission system because it was just this big kind of wall of checkboxes.

• 9:30Wes Bos?

  Grid of checkboxes.

• 9:31Scott Tolinski?

  Yeah, I can, yeah. I tried to build that with a PocketBase the other day, actually. Yeah, it was actually kind of fun.

• 9:38Wes Bos?

  So our next step here is let in, don't lock down. Meaning that you should not be allowing people to access data or, or send post requests to endpoints and then you have to go in and lock it down. You, you should be the opposite. Is everything should be locked down by default and you should only be letting through the people that are allowed. And Firebase had kind of an oopsie over, I don't know, a long time ago, and they're still paying for it, is when Firebase first rolled out, everything was wide open. And, and it was great because you could just throw it in there and you could just start saving stuff and, and building an app really quickly. Yeah, and you didn't get, you didn't get like, like bogged down by this annoying access control.

• 10:23Wes Bos?

  The problem is people never actually went back and, and locked it down.

• 10:28Scott Tolinski?

  Yeah. I will say the creator of Meteor said that that was one of his biggest regrets in creating it, was not having it be locked down by default. And ZeroSync had the same issue. It was open by default and then they have since, because it's an alpha, have since changed it to be the opposite. It's, it's denied by default and you have to open it up, which is great. That's the way it should be.

• 10:47Wes Bos?

  Even, like, I have one Firebase.

• 10:51Wes Bos?

  Database from like a tutorial I did a long time ago. And they send me an email every single day like, hey, your access controls are insecure because of X, Y, and Z. And it's because people can, if you have it wide open by default, you can just say list all of the endpoints and then you can loop through each of the endpoints and see what is available there. So this is not a new thing, right? This is how a lot of firewalls work, right? Block everything by default, but let people in. Don't reactively go and lock things down.

• 11:22Scott Tolinski?

  Yes. Next thing we have here is be very clear about code that runs in the server or the client. And in regards to locking things down, you cannot lock things down from the client in that way. You cannot, if the access control is happening only on the client side, that's not access control. That's a sign that people can get around. You, you need the access control to happen at like the, the server level when you're querying from the database itself.

• 11:53Wes Bos?

  Yeah. And this can get a little bit muddy with a lot of these like React server components and like all of these meta frameworks allow you to mix your server logic and your client logic in the same folders. And in some cases, even in the same files. That's great because it's, the developer experience is awesome, especially if you've got util's where like, like a format money function is something I have all the time. Right? I want to be able to use that same function on the client and on the server. But there, there are some things like databases where you simply do not want that to, to be able to accessible on the client side. And if you simply import the wrong thing into a file, there are lots of checks to make sure you're not doing something bad,

• 12:37Wes Bos?

  but you can let things slip through. So be very clear about how you do that. And I know like, like Svelte has a .server.js file.

• 12:47Scott Tolinski?

  They now have a remote files.

• 12:49Wes Bos?

  Oh, they now.

• 12:50Scott Tolinski?

  Which is their ., .remote file, not, oh, they did have server though, right? Well, the server thing is for, yeah, code that runs specifically on the server could be endpoints or whatever. But now their new RPC thing, which is very more similar to React server components, is these remote files, which only run on the server. Because one of their core principles in designing these things was, we want zero ambiguity as to what is running on the client and what is running on the server. Like, zero ambiguity. We don't want to, we don't want them to mix, although we want it to be easy.

• 13:21Wes Bos?

  Yeah. In React land, you can pop a use server on there. So you have to be a little bit explicit where if you do want to do this, it's, it's kind of hard to accidentally do it. But there are cases where it can be like, in mine, I wasn't using a framework. So before you know it, it's, it slipped all that code from the server into the client. And I'm lucky that I caught it.

• 13:45Scott Tolinski?

  Yeah, for sure.

• 13:46Wes Bos?

  Visualize your access control. Kind of talked about this as well, but simply just have some sort of QB editor. So you can see who has access to what. One thing I don't have on this list here, but I do want to say is that like, AI might be the solution to AI. And, and like, you can vibe code something. And then you can take maybe even just another model and ask it to like, hey, can you go through this and check for, for any security issues? Because AI is, is very good at detecting possible issues that can pop up. So I don't think it's the single thing that can happen.

• 14:27Wes Bos?

  But I do think that you can ask the AI to kind of rip through your code base, especially when you get into some of these bigger, like Claude Code or Max Mode on Cursor, things like that, where you can just like let it rip for hours on end. It will go through it and not just kind of do a half-assed job at it.

• 14:47Scott Tolinski?

  Yeah. You know what? Even, even with the visualizing your thing, there's a definitely like a conversation that we're not having in this episode. But when we say access controls, that could mean, you know, assigning individual access controls themselves. Can edit, can delete, whatever, as a means of controlling access.

• 15:08Scott Tolinski?

  Or a role-based access system where this role has access to the following access parameters and only these ones. So this role can do this. Like I am an admin, therefore I can do this. I'm a super admin, therefore I can do everything. Or you can control it on a more micro level and say, this particular person is capable of doing these following things.

• 15:30Wes Bos?

  Last thing is automate, automate tests. It's very easy to even, you can go ahead and ask AI to, to spin up a whole bunch of automation tests for all the different access roles. And then anytime you have a change, you can, you can run those tests. And if one of those fails, oops, something changed for these types of things. So like, I don't know that the, the AI is going to entirely help you here. I really think that it's one thing to vibe code a bunch of UIs and some really neat stuff. And to scaffold out components, be able to update stuff. But when it comes down to the very, very important stuff, which is protecting your users and the security of your application, security of your customers.

• 16:14Wes Bos?

  This is one thing, at least for now, you really should pay attention to and not just throw out.

• 16:20Scott Tolinski?

  Word.

• 16:21Wes Bos?

  That, that's all I got today. Very short episode, but it's something I wanted to talk about because I feel like we're in for a rough couple, couple of years of these vibe-coded apps having major security issues. And, and it's not just like a ha ha funny, because like this is,

• 16:36Scott Tolinski?

  No, yeah.

• 16:37Wes Bos?

  This, like these, these women that have these photos on there, like that, that could, that could end poorly.

• 16:43Scott Tolinski?

  Yeah. I, I did see even like the, the app that somebody made to counter the T app also had a massive security vulnerability.

• 16:53Wes Bos?

  Oh, boy.

• 16:53Scott Tolinski?

  So folks, yeah, serious business for real. Oh my word.

• 17:00Wes Bos?

  Uh, let's grab some sick picks. So, uh, sick pick is the section of the episode where we pick things that are sick, can be literally anything from our lives. Couple of episodes ago, I was talking about wanting to make my house smell better and how I want my office to smell like Abercrombie or something like that. So what we're doing right now is we're going through and looking for a scent that we want our, our house to smell like. And what I did is I ordered like a tester of a hotel, a hotel collection.

• 17:31Scott Tolinski?

  I saw that.

• 17:31Wes Bos?

  And this is, it's like, what? It has,

• 17:36Wes Bos?

  The Ritz Carlton, the Weston, Marriott, Fairmont, Hilton, and Four Seasons. And you know, you walk into a lobby of a fancy hotel, like, hmm, it smells nice in here. And for like, like 20 bucks, you get a little essential oils. And we're, right now, we're just throwing them into like a regular diffuser. But the plan is to hook it up to the HVAC once we actually find something that we like.

• 17:58Scott Tolinski?

  I did do some research there. I don't know how much you've done, but apparently that you need a whole dang, specific built-in unit, rather than just like dabbing them on the air filter, which is what I was hoping to be able to do.

• 18:09Wes Bos?

  A lot of people told me that they just spray it on their air filter and you're ready to go, but our furnace doesn't have like those like paper air filters. We have like a metal one that zaps stuff. So every now and then you'll hear, and it's like some, some piece of whatever is like a fly or a piece of dust went through it. So I don't know about that. Yeah, you gotta buy like this little atomizer unit. And then you gotta drill a hole through your HVAC in it and pop the thing in there. And every 20 seconds or so, it'll do a tiny little into the, into the air. But anyways, this hotel collection, very cool. I don't know that it's one for our entire house, but I have fallen in love with the

• 18:53Wes Bos?

  Ritz Carlton one, you know? It's a little, a little manly. My kids say it smells like deodorant, which kind of kills me, but I, I really like it. It's kind of, kind of manly, but kind of nice, you know? It's got a little bit of sandalwood in it and it's just been like a really fun way to like, to find different scents. I don't, we haven't found the, the one yet, but I would highly recommend grabbing one of these testers if you're looking to make your house smell good, too.

• 19:20Scott Tolinski?

  That's so fun. I can't wait to hear what you find out about the HVAC stuff. Cause that, it sounds so stupid, but man, that sounds like something that actually would be nice to have. Depends on how expensive that ultimately ends up being.

• 19:33Wes Bos?

  I think it's like a hundred or 200 bucks for like an atomizer. So it's not, not dirt cheap, but like not brutal. I also don't know how much the-

• 19:42Scott Tolinski?

  It's a little brutal.

• 19:43Wes Bos?

  The cost of the oils is, you know, like, are you burning through a hundred bucks a month in this? And if that's the case, I maybe wouldn't do that.

• 19:51Scott Tolinski?

  You could get essential oils for cheap, maybe not the Ritz Carlton blend, but I, trust me, I was hunting black widows with essential oils because there's some essential oils they don't like. And you could get some big old things of essential oils for cheap.

• 20:07Wes Bos?

  Really?

• 20:08Scott Tolinski?

  Because, yeah, oh yeah, I was, dude, I was at Spritz and everything all the time, every night. Get these black widows out of my house. They weren't in my house, they were in my patio furniture at my old house. That was the old house charm. It was buy Whole Foods, but we had black widows. What are you gonna do there? What are you gonna pick?

• 20:25Scott Tolinski?

  Yeah, no, I do love a good scent and definitely want something that's easier than just putting diffusers all around the house all the time.

• 20:32Wes Bos?

  Yeah, apparently those like plug-in ones are not good for you as well. That's, that's why-

• 20:35Scott Tolinski?

  No, we don't do those, yeah.

• 20:37Wes Bos?

  I was asking if they're good for you because apparently it's awful just to breathe that in all day. But, but the essential oils is fine. I don't know.

• 20:45Scott Tolinski?

  Some people say the essential oils give you superpowers. I don't know if you remember that. There's like an LLM, like this essential oil makes you-

• 20:49Wes Bos?

  Oh yeah, that's what we have. We've got the Duterra thing. I don't know if we fell for it or not, but yeah, we, like, one of our friends came over and, like, one of our friends is like a, like a boss babe, like makes bank. Bank, like, not like a, like a shake your friends down and ruin all your relationships MLM, but like, like top dog, driving a Mercedes, like buying houses, like got in early on the whole Duterra thing and is making bank on essential oils.

• 21:22Scott Tolinski?

  Well, sick, I'm gonna sick pick a book. I read a book called A City on Mars. I found this book to be really excellent. It's kind of a very practical look at what it would take to colonize places in space, whether that is like the moon or Mars or otherwise. And it's very fun. Uh, it's done in a fun way and it talks very practically, like about most, if not all of the major challenges that would exist, of which are endless and many seeming insurmountable. So like for people who might have been like- Oh yeah, let's just get a base on Mars or on the moon or something like that.

• 22:05Scott Tolinski?

  This will like really help you understand just how insane of a challenge that would all be given our current technology today. And it's definitely kind of like a no nonsense thing while being fun in a fun read. So they talk about all things from like psychology to reproduction, to food and farming, to locations and radiation and even travel. It is, it was a great little book. So yeah, check it out. I guess it came out in 2023, 2024. I really enjoyed this one.

• 22:41Wes Bos?

  Beautiful. All right. Thanks everybody for tuning in and we will catch you in the next one.

• 22:46Scott Tolinski?

  Peace. Peace.