I ran someone else's vibe-coded app through four AIs at once. Here’s what they found in an hour

Описание и применение

Пайплайн из четырёх ИИ выявил в час критические уязвимости в приложении на Flask: жёстко закодированный ключ, небезопасная проверка JWT и случайный сбой при входе. Это демонстрирует, что внешняя проверка ИИ может обнаружить скрытые проблемы, которые модель‑автор пропускает.

Задача

AI‑generated code often contains hidden security vulnerabilities that are not detected by the model that wrote it.

Результат

The four‑model pipeline found a hard‑coded master key, insecure JWT verification, and a padding bug that caused intermittent login failures in an hour, proving that external AI reviews can uncover hidden security flaws.

Рабочий процесс

• 1. Pull open‑source repo (Python/Flask task‑management app).
• 2. Run first AI model to generate a plan and catch obvious problems.
• 3. Run second AI model to perform deep analysis of logic, edge cases, and side effects.
• 4. Run third AI model to inspect boundaries, safety, and overlooked issues.
• 5. Run fourth AI model to consolidate findings, decide clean or rework, and produce a report.
• 6. Review report, fix identified issues, and optionally re‑run pipeline for confirmation.

Доказательства

The first builds a plan and catches the crude stuff. The second, the mean one, digs deep — what breaks, where the side effects are, which edge cases.

Источник

Finding one: a master key hardcoded right into the source

Источник

The app hands a logged‑in user a digital pass (a JWT) and later recognizes them by it.

Источник