"Securing AI and Vibe-Coded Apps" is one of this site's trend clusters this week — 28 posts in seven days about the same genre of accident: an app built at chat speed, shipped at chat speed, with a database policy disabled here and a live credential pasted there. The cluster's own question list asks what the most common oversights are and how you audit an app before launch.

I wanted a number, not a vibe. So I wrote the app everyone is worried about — 32 lines of Flask in the exact style a coding assistant produces when you ask it to "just make it work" — and then I audited it the way the cluster suggests: a real scanner (Bandit 1.9.4, the standard Python security linter), plus a plain-text search for the key pattern, the way secret scanners hunt.

The app, with its sins labelled by nobody — it doesn't know it's a test:

A /user route that builds SQL with an f-string.

A /ping route that runs a shell command built from the query string.

A /file route that opens whatever path you hand it.

A /calc route that…