Happy Friday all,
I thought I’d kickstart a discussion thread around the craziness that has taken over the internet in the past 48 hours.
The AI summary from X:
And more recently, we’ve got Node.js impacted as well:
It’s tough not to be too ominous about all of this, with the head of cybersecurity at Anthropic saying stuff like this:
Yes, I was following that 
That’s why I had another discussion in another thread yesterday about magic links and all that. Didn’t think anyone else was really following all this, but anyone who was would know what I was referring to.
With all this going on, it’s wild to see people recommending headless magic-link cookie scraping and admin token bypasses just to duct-tape an AI agent to an app.
The biggest problem from this is definitely going to hit vibe-coded apps where nobody audited the endpoints. Most coded apps already had safeguards in place.
For Bubble apps, I would think it’s a good idea to check old server-side plugins, privacy rules, and public backend workflows.
Glad to see someone else was actually seeing all the reports 
Yeah, its going to be a tough couple of years IMO.
The ability AI has to chain small flaws together to make large exploits is concerning. We are just getting started and I am excited to see what security innovations are put out in the near future.
It’s easier to build software but all these security vulnerabilities being exposed means we need to better understand how good software is built.
AI lowered the ceiling but raised the floor.
I’m just praying that Bubble is Daybreakmaxxing etc. and taking this seriously. It will get worse before it gets better. I think one weird implication of this is that the era of the “indie hacker” will be over, no way for a single person to compete against superhardened enterprise software that’s been checked over by billions of tokens.
With Bubble, you get so many security protections out of the box. So many people take this for granted.
Your biggest defense is privacy rules, and that’s on each user…
Bubble makes those so easy; it’s crazy.
That’s why, when I read about people wanting to move to code, I think they have no idea what they’re getting into.
A typical agency would charge like $10K to check your rules. With Bubble, you just click some boxes.
There are scanners, bots, and everything else working 24 hours a day to find weak spots. Nobody thinks about this stuff unless they’ve seen the horror stories and experienced it. With Bubble, as I said, you just have so many protections already. I would say stay with Bubble as long as you can and then only leave if you absolutely need to…
Which could be never.
I’ve seen a couple of apps that say they will scan your vibe coded app and look for vulnerabilities…
But I mean, how ironic: the scanner is built by AI, which caused the problems in the first place, and now you’re using an AI-built tool to find the problems? I did try one out of curiosity, and it was nothing developer tools wouldn’t have found.
Of course, if you were a professional agency for coded apps, you would use OWASP Zap or Burp Suite (by point swigger). But I would never recommend anyone using either of these unless you’re a professional. You can easily get your IP banned or/and rack up bills in the thousands. Yes, it’s happened more than a few times.
As I mentioned, I think the best free thing anyone has is the developer tools. Lots of ways to use them. You can use Google for help. It would take a lot to explain all the ways they can help.
Also, as I said, plugins. Can’t even start to explain what could go wrong. Developer tools can help with these too.
Overall, though, privacy rules, plugins, and backend workflows, I think, would be what everyone should check.
More experienced Bubblers might have some other things to check 
Anyway, have a good weekend
Heh.
There’s a lot of low-hanging fruit for sure across the platform as a whole.
Yes.
An interesting statistic…
About 50% of all the traffic on the internet is bots.
Some are good bots, of course, like Googlebot, search engines, uptime monitors, etc. But about 20% are bad bots. You can Google this, and the percentages vary depending on who gives the statistics, but they’re all close.
Also, every site gets hit with bad bots daily. Depending on what your site offers, it will depend on how hard they hit it.
If you have a site where users can signup/login with their phone number, you’re a prime target. I have a couple of non-Bubble sites like this. Other things also that would take too long to go into.
Just a couple of very simple things you can do to protect yourself on Bubble:
Create a honeypot. I talked about this before on here. It takes about 10 seconds. It’s an input field on your form that is 1 px by 1 px and asks for, like, a company name, fax number, or zip code. If that is filled in, the submit button rejects it. Bots will fill it in.
Set up a turnstile. Takes like 5 or 10 minutes. Put it in an HTML element above your submit button.
Set a timer so the form can’t be submitted within, say, 3 seconds of when the page is loaded. Bots fill out forms and submit them within milliseconds.
Sometimes I see posts on here where people say they had a bot attack and their work units jumped through the roof.
These are just 3 simple things you can do to stop most of that.
Added: I was in a hurry typing this…
What I meant to say is that even if the honeypot, etc., failed the test, on the submit button still do a success toast so the bot won’t keep trying to figure out what they did wrong.
Oh well, everyone enjoy their weekend. It’s getting colder here in Ohio 
