I ran someone else's vibe-coded app through four AIs at once. Here’s what they found in an hour

说明与用途

四个 AI 组成的流水线在一小时内发现了 Flask 应用的三大安全漏洞：硬编码主密钥、JWT 验证不安全以及因填充错误导致的随机登录失败。证明外部 AI 审查能发现原作者忽略的隐藏问题。

问题

AI‑generated code often contains hidden security vulnerabilities that are not detected by the model that wrote it.

结果

The four‑model pipeline found a hard‑coded master key, insecure JWT verification, and a padding bug that caused intermittent login failures in an hour, proving that external AI reviews can uncover hidden security flaws.

工作流

• 1. Pull open‑source repo (Python/Flask task‑management app).
• 2. Run first AI model to generate a plan and catch obvious problems.
• 3. Run second AI model to perform deep analysis of logic, edge cases, and side effects.
• 4. Run third AI model to inspect boundaries, safety, and overlooked issues.
• 5. Run fourth AI model to consolidate findings, decide clean or rework, and produce a report.
• 6. Review report, fix identified issues, and optionally re‑run pipeline for confirmation.

证据

The first builds a plan and catches the crude stuff. The second, the mean one, digs deep — what breaks, where the side effects are, which edge cases.

来源

Finding one: a master key hardcoded right into the source

来源

The app hands a logged‑in user a digital pass (a JWT) and later recognizes them by it.

来源