Trails for vibe coders

Sign-in, permissions, and the leaks AI-built apps ship most often.

1. Free · 4 minInvoice 105Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
2. Pro · 5 minThe table anyone can readYour app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
3. Pro · 4 minThe admin buttonOnly admins see the Refund button. A regular user has just refunded their own last three orders.
4. Pro · 4 minOne field, a million creditsA free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.
5. Pro · 4 minThe bucket of ID photosUsers upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.
6. Pro · 4 minOpen it in incognitoEverything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
7. Pro · 4 minThe redirect that let them inYour middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
8. Pro · 4 minThe app id is not a passwordYour company's internal HR app is 'private'. A stranger has just signed up and is reading salary data.
9. Pro · 4 minDay 31: permission deniedYour app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.
10. Pro · 4 minPermission denied for tableYour AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Follow one button press from the browser to the database and back.

1. Free · 4 minThe save that saved nothingA user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.
2. Pro · 4 minWorks on my machineSign-up works perfectly on your laptop. On the live site, every sign-up fails.
3. Pro · 5 minThe double orderA customer on slow hotel wifi taps Pay twice. They are charged twice and get two orders.
4. Pro · 4 minConfirm email, reach localhostYour first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.
5. Pro · 4 minLogged out after an hourUsers fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.
6. Pro · 4 minBlocked by CORSYour API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.
7. Pro · 4 min4am for a 10am bookingA customer in Chicago books a 10am appointment. Your confirmation email says 4am. The calendar page says 10am.

Keys, payments, webhooks, and reading what your AI changed.

1. Free · 4 minThe key in the bundleYour OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
2. Pro · 5 minThe webhook that arrived twiceA customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.
3. Pro · 5 minThe fix that made it worseA customer with orders sees 'No orders yet'. You asked your AI to fix the orders page. It says: 'Fixed! Everything works now.'
4. Pro · 4 minThe key you deletedYour AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.
5. Pro · 4 minCancelled on day 3Two support emails. One customer cancelled in October and still has Pro in December. Another lost access the moment they clicked Cancel, with 27 paid days left.
6. Pro · 4 minThe key you pasted into chatTo get Stripe working, you pasted your secret key into your app builder's chat. The project was public. Your builder has just announced a data exposure.
7. Pro · 4 minOff by one centA customer emails a screenshot: their invoice total reads £0.30000000000000004. Your accountant says the monthly totals are a few pennies off.

Agents that reset production, backups that are a day old, rollbacks that break.

1. Free · 5 minThe agent that reset productionYou asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.
2. Pro · 4 minThe backup that wasn't thereAt 4pm a bad script deletes your orders table. You open the backups page expecting to undo it.
3. Pro · 4 minBack to yesterday's versionToday's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.
4. Pro · 4 minExactly 1,000 ordersYour admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.
5. Pro · 3 minProject pausedA quiet week, then a client demo. Your app shows errors. Your database dashboard says 'Project paused'.

Open AI endpoints, bot traffic, fake signups and functions that loop forever.

1. Free · 4 minThe open summarise buttonYour app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.
2. Pro · 4 minA quiet week, a loud billAlmost nobody visited your site this week. Your hosting bill is forty times higher than usual.
3. Pro · 4 min500 signups overnightYou give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.
4. Pro · 4 minThe update that updates itselfYou added a function that stamps 'updated_at' whenever a profile changes. By morning your database bill has a new digit.
5. Pro · 4 min2 million requests from one tabYou left your dashboard open overnight. Your database usage page shows 2 million requests from a single browser.
6. Pro · 4 minThe 40,000 SMS codesYour phone sign-in sends a code by SMS. Overnight it sent 40,000 codes to numbers in countries you do not serve.
7. Pro · 5 minThe 4 MB thumbnailYour marketplace shows 24 small product photos per page. On phones it takes ages to load, and your storage bill warns you are over your data transfer limit.
8. Pro · 5 minThe address box that cost $1,900Your checkout suggests addresses as people type, using a maps API. Orders are steady, but this month's maps bill is $1,900.

Dangerous commands, fix loops, deleted tests, prompt injection and invented packages.

1. Free · 4 minApprove this command?Your coding agent wants to clean up old build files before a fresh build. It asks you to approve one command.
2. Pro · 4 min'Fixed!' for the fourth timeYour AI has said 'Fixed!' four times. The bug is still there, login now fails too, and you have spent the afternoon's credits.
3. Pro · 4 min48 green testsYou asked the AI to make the failing tests pass. All 48 tests are green. Yesterday there were 61.
4. Pro · 5 minThe ticket that gave ordersYour coding agent is connected to your database so it can triage support tickets. One ticket is not quite a question.
5. Pro · 4 minThe package that did not existYour AI adds a package called 'next-auth-helpers-pro' to fix sign-in. The install prints a lot of output you do not recognise.
6. Pro · 4 minThe bot that gave a discountYour app's AI sales assistant just emailed a customer a 100% discount code. Nobody on your team created it.
7. Pro · 4 minForce-pushed awayYour agent 'cleaned up the branch' to resolve a conflict. Three days of commits are gone from GitHub.
8. Pro · 4 minThe chatbot that wrote hidden codeYour app lets users share AI chat conversations. Everyone who opened one shared chat got signed out, and their sessions were used elsewhere.
9. Pro · 5 minThe 3,000-line fileChanging a button's colour took your AI ten minutes, cost a pile of credits, and somehow broke the sign-up form.
10. Pro · 5 minThe commit that broke checkoutCheckout broke this morning. Since then you have also shipped discount codes, which work and which customers are already using.

Emails that never arrive, sign-in errors, timeouts, stale prices and connection limits.

1. Free · 4 minLaunch day, no emailsYour own test signups always got their email. You launch on Product Hunt, forty people sign up, and not one receives the confirmation email.
2. Pro · 4 minSign in with Google: Error 400'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.
3. Pro · 4 minThe 504 at second 60Generating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.
4. Pro · 4 minThe old priceYou raised your price an hour ago. Your admin page shows the new price. Customers are still checking out at the old one.
5. Pro · 4 minEvery page spins foreverYour post goes viral. Within minutes every page spins, then fails. Your database dashboard says CPU is nearly idle.
6. Pro · 4 minThe reminder that never cameYour app promises 'We'll remind you in 24 hours'. Nobody has ever received the reminder.
7. Pro · 4 minFast with 50 rows, slow with 20 millionYour orders page was instant in testing. Two years and 20 million orders later, it takes eight seconds to load.
8. Pro · 4 minInvisible to GoogleYou published thirty blog posts over three months. Google shows only your homepage.
9. Pro · 4 minThe upload that was too bigUsers can upload photos to their listings. Phone photos fail with '413 Payload Too Large'. Screenshots work fine.
10. Pro · 4 minSame answer, 50,000 timesYour product pages show prices in the visitor's currency. Pages feel slow, and the currency API bill grows with every visitor.
11. Pro · 4 minTwelve requests on the home pageYour home page is mostly text and a sign-up button. The Network tab shows twelve API calls before it finishes loading, some of them failing.