LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Money and secrets

Money and secrets

Money problems in vibe-coded apps come from three places: secret keys shipped to the browser, payment webhooks handled twice or never verified, and AI 'fixes' that delete a safety check to make an error go away. This trail covers all three.

Scenarios
7
Total time
30 minutes
Free to try
The first one

7 scenarios on this trail

  1. Next up · Free · 4 minThe key in the bundleYour OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
  2. Stop 2 · Pro · 5 minThe webhook that arrived twiceA customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.
  3. Stop 3 · Pro · 5 minThe fix that made it worseA customer with orders sees 'No orders yet'. You asked your AI to fix the orders page. It says: 'Fixed! Everything works now.'
  4. Stop 4 · Pro · 4 minThe key you deletedYour AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.
  5. Stop 5 · Pro · 4 minCancelled on day 3Two support emails. One customer cancelled in October and still has Pro in December. Another lost access the moment they clicked Cancel, with 27 paid days left.
  6. Stop 6 · Pro · 4 minThe key you pasted into chatTo get Stripe working, you pasted your secret key into your app builder's chat. The project was public. Your builder has just announced a data exposure.
  7. Stop 7 · Pro · 4 minOff by one centA customer emails a screenshot: their invoice total reads £0.30000000000000004. Your accountant says the monthly totals are a few pennies off.

Other trails

  • Who may see what

    Sign-in, permissions, and the leaks AI-built apps ship most often.

  • The life of a click

    Follow one button press from the browser to the database and back.

  • Data you can lose

    Agents that reset production, backups that are a day old, rollbacks that break.

  • Bills that explode

    Open AI endpoints, bot traffic, fake signups and functions that loop forever.

  • Working with your AI agent

    Dangerous commands, fix loops, deleted tests, prompt injection and invented packages.

  • Launch day

    Emails that never arrive, sign-in errors, timeouts, stale prices and connection limits.

Sign in
  1. Next up · Free · 4 minThe key in the bundleYour OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
  2. Stop 2 · Pro · 5 minThe webhook that arrived twiceA customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.
  3. Stop 3 · Pro · 5 minThe fix that made it worseA customer with orders sees 'No orders yet'. You asked your AI to fix the orders page. It says: 'Fixed! Everything works now.'
  4. Stop 4 · Pro · 4 minThe key you deletedYour AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.
  5. Stop 5 · Pro · 4 minCancelled on day 3Two support emails. One customer cancelled in October and still has Pro in December. Another lost access the moment they clicked Cancel, with 27 paid days left.
  6. Stop 6 · Pro · 4 minThe key you pasted into chatTo get Stripe working, you pasted your secret key into your app builder's chat. The project was public. Your builder has just announced a data exposure.
  7. Stop 7 · Pro · 4 minOff by one centA customer emails a screenshot: their invoice total reads £0.30000000000000004. Your accountant says the monthly totals are a few pennies off.