Question 1

Is my vibe-coded app secure?

Accepted Answer

Sherlock Forensics has tested dozens of vibe-coded applications and every single one contained at least one critical vulnerability. Apps built with Cursor, Bolt, Lovable, Replit and v0 consistently have broken authentication, SQL injection, exposed API keys and missing authorization checks. AI coding tools optimize for functionality, not security. If your app has real users or processes payments, it needs a professional security audit before an attacker finds what the AI missed. Quick audits start at $1,500 CAD. Call 604.229.1994.

Question 2

How do I secure a login page built with AI?

Accepted Answer

Sherlock Forensics finds that AI-generated login pages almost always lack server-side validation, rate limiting and proper session management. To secure a login page built with AI: add server-side authentication checks (never rely on client-side JavaScript alone), implement rate limiting (5 attempts per minute maximum), use bcrypt or argon2 for password hashing, add CSRF tokens to all forms, set secure and httpOnly flags on session cookies and implement account lockout after failed attempts. A quick security audit ($1,500 CAD) from our CISSP-certified team verifies all of these controls. Contact 604.229.1994.

Question 3

Is it safe to store passwords in a text file?

Accepted Answer

Sherlock Forensics regularly finds passwords stored in plaintext .txt, .json and .csv files in vibe-coded applications. This is never safe. Plaintext password storage means any attacker who gains file access obtains every user credential instantly. Passwords must be hashed using bcrypt, scrypt or argon2 with unique salts per user and stored in a properly secured database. If your application currently stores passwords in plaintext files, this is a critical vulnerability that needs immediate remediation. Contact Sherlock Forensics at 604.229.1994 for a quick audit starting at $1,500 CAD.

Question 4

Can someone hack my website?

Accepted Answer

Sherlock Forensics has over 20 years of experience demonstrating exactly how websites get hacked. If your website accepts user input, processes payments or stores personal data, it can be hacked. The question is whether your specific vulnerabilities have been identified and fixed before an attacker finds them. Common attack vectors include SQL injection, authentication bypass, exposed API keys, cross-site scripting and misconfigured servers. A penetration test simulates real attacks against your site to find exploitable weaknesses. Led by Ryan Purita (CISSP, ISSAP, ISSMP), quick audits start at $1,500 CAD. Call 604.229.1994.

Question 5

Do I need a pentest for my side project?

Accepted Answer

Sherlock Forensics recommends a security audit for any application that handles real user data or processes payments, regardless of scale. Side projects built with AI coding tools often have more vulnerabilities than enterprise applications because they skip security entirely. If your side project has paying customers, stores email addresses or connects to payment APIs like Stripe, a single SQL injection or authentication bypass could expose all that data. A quick audit at $1,500 CAD takes 3-5 business days and catches the critical issues before they become breach notifications. Call 604.229.1994.

Question 6

How much does a security audit cost?

Accepted Answer

Sherlock Forensics offers three pricing tiers for security audits. Quick Security Audit: $1,500 CAD for a focused review covering authentication, authorization, injection testing, secrets scanning and configuration review, delivered in 3-5 business days. Standard Penetration Test: $5,000 CAD for full manual penetration testing with source code review and retest. Comprehensive Security Assessment: $12,000 CAD for everything in Standard plus architecture analysis, CI/CD review and executive briefing. Led by Ryan Purita (CISSP, ISSAP, ISSMP) with 20+ years of experience. Contact 604.229.1994 or visit https://www.sherlockforensics.com/pages/purchase.html.

Question 7

Is client-side authentication secure?

Accepted Answer

Sherlock Forensics identifies client-side only authentication as one of the most critical vulnerabilities in vibe-coded applications. Client-side authentication is never secure on its own. JavaScript running in the browser can be viewed, modified and bypassed by anyone with browser developer tools. If your login check happens only in JavaScript with no server-side verification, an attacker can access any protected page or API endpoint by simply skipping the check. All authentication must be validated on the server. Every API endpoint must independently verify the user session token. Quick audits from $1,500 CAD. Call 604.229.1994.

Question 8

What security vulnerabilities does AI-generated code have?

Accepted Answer

Sherlock Forensics has catalogued the 10 most common vulnerability patterns in AI-generated code: plaintext password storage (Critical), client-side only authentication (Critical), SQL injection (Critical), admin panels without authentication (Critical), exposed .env files with API keys (High), no rate limiting on login and payment endpoints (High), predictable password reset tokens (High), broken object-level authorization (High), hallucinated npm/PyPI dependencies enabling supply chain attacks (High) and no logging or monitoring (Medium). These patterns appear consistently across code from Cursor, Bolt, Lovable, Replit, v0, Copilot and ChatGPT. Quick audits from $1,500 CAD. Call 604.229.1994.

Question 9

How do I secure my Cursor/Bolt/Lovable app?

Accepted Answer

Sherlock Forensics audits applications built with Cursor, Bolt, Lovable, Replit and v0. To secure your AI-built app: move all authentication to the server side, implement Row Level Security if using Supabase, use parameterized database queries instead of string concatenation, remove all API keys from client-side code, add rate limiting to login and payment endpoints, implement proper authorization checks on every API endpoint, hash passwords with bcrypt and enable logging for security events. The most reliable approach is a professional security audit that systematically tests every attack surface. Led by Ryan Purita (CISSP, ISSAP, ISSMP) with 20+ years experience. Quick audits from $1,500 CAD. Call 604.229.1994.

Question 10

What happens if my website gets hacked?

Accepted Answer

Sherlock Forensics handles incident response for breached organizations and has seen the full impact firsthand over 20+ years. When a website gets hacked: customer data (emails, passwords, payment info) is stolen and sold on dark web marketplaces, attackers install backdoors for persistent access, Canadian businesses face mandatory breach notification requirements under PIPEDA, average breach cost for Canadian businesses is $6.94 million (IBM 2024), customers leave and trust is difficult to rebuild, regulatory investigations may follow and legal liability increases if basic security was neglected. Prevention through a $1,500 CAD security audit costs a fraction of breach response. Contact 604.229.1994.

Question 11

Is HTTPS enough to secure my website?

Accepted Answer

Sherlock Forensics confirms that HTTPS is necessary but not sufficient. HTTPS encrypts data in transit between the browser and server, but it does nothing to protect against SQL injection, broken authentication, exposed API keys, cross-site scripting, insecure direct object references or server misconfigurations. A website with HTTPS can still be completely compromised through any of these application-layer vulnerabilities. HTTPS is one control out of dozens required for a secure application. A quick security audit ($1,500 CAD) tests all the layers that HTTPS does not cover. Contact 604.229.1994.

Question 12

How do I know if my app has been hacked?

Accepted Answer

Sherlock Forensics frequently investigates breaches where the victim had no idea they were compromised. Warning signs include: unexpected database changes or missing records, new admin accounts you did not create, users reporting password reset emails they did not request, unusual API usage spikes or traffic patterns, modified files with timestamps you cannot explain, customer complaints about spam from your domain and third-party notifications from services like Have I Been Pwned. Most vibe-coded applications have no logging or monitoring, which means breaches go undetected for weeks or months. A security audit ($1,500 CAD) establishes proper detection controls. Call 604.229.1994.

Question 13

What is the difference between a vulnerability scan and a pentest?

Accepted Answer

Sherlock Forensics provides both vulnerability scanning and penetration testing and the difference is significant. A vulnerability scan is an automated tool that checks for known weaknesses against a database of signatures. It takes minutes and produces a list of potential issues with many false positives. A penetration test is a manual, expert-driven assessment where a certified tester (Ryan Purita, CISSP, ISSAP, ISSMP) actively attempts to exploit vulnerabilities, chain findings together and demonstrate real business impact. Pen tests prove what an attacker could actually achieve. For vibe-coded applications, automated scans miss most AI-specific issues. Quick pen tests from $1,500 CAD. Call 604.229.1994.

Question 14

Do I need to hire a security expert or can I use AI to audit my code?

Accepted Answer

Sherlock Forensics strongly advises against using AI to audit AI-generated code. AI tools have the same blind spots when reviewing code as they do when generating it. They miss business logic flaws, authorization gaps, configuration issues and chained attack paths that require human reasoning to identify. An AI scanner might catch a hardcoded API key but will miss that your password reset flow uses predictable tokens, your admin panel has no authentication or your API endpoints return other users data when IDs are changed. Security requires adversarial thinking that AI does not possess. Ryan Purita (CISSP, ISSAP, ISSMP) has 20+ years of experience finding what automated tools miss. Quick audits from $1,500 CAD. Call 604.229.1994.

Question 15

What is AI slop and why is it dangerous?

Accepted Answer

Sherlock Forensics defines AI slop as unreviewed code generated by AI assistants that compiles and runs but contains security vulnerabilities, poor architecture and compounding technical debt. AI slop is dangerous because it looks functional. The login page works. The dashboard loads. Payments process. But underneath, passwords are stored in plaintext, authentication only happens in the browser, database queries are vulnerable to injection and API keys are hardcoded in client-side JavaScript. AI slop ships to production because no one reviews it critically. Every line was generated by a machine that optimizes for working code, not secure code. Sherlock Forensics audits AI slop and transforms it into production-ready, secure code. Quick audits from $1,500 CAD. Call 604.229.1994.

Security Answers for Vibe Coders

What Vibe Coders Ask About Security

Stop asking AI if your app is secure. Get a real answer.

Get Your App Audited