Ask HN: Are you hesitant to install vibe-coded apps?
The thing is in the past there can be supply chain attacks but when its an actual programmer creating the software there is at least a chance for them to notice if something is up. But if the app is not even created by a programmer whats stopping prompt injection from including some virus in the app? Aren't we completely blind to security issues at that point?
Discussion Highlights (12 comments)
fodkodrasz
No. I simply don't (apart from company mandated ones like Claude Code), or do it in isolated VMs.
timpera
At this point, I always ask my AI tool of choice to audit the Github before installing an open-source tool, so I'm not that concerned about security. I'm mostly hesitant to install vibe-coded apps because they sadly tend to be shiny but quickly-abandoned slop, with tons of bugs or performance issues.
ezrasu
Speaking from the builder side: In my case no. To prevent this sort of problem I would like to learn relate knowledge then ask agent to audit one by one. User side: write a skill then ask Agent to audit it rather than just ask agent with one sentence
redrove
Depends on the type of app, complexity, and product space. If it’s something I know well and it’s simple — why not vibe code my own?
fnoef
How do you know if it's vibe coded or not? 60% of any app is third party dependencies that some random guy across the globe maintains, and the developer never even checked how the code is written. Also, why vibe coded apps are prone to have viruses, and non vibe coded apps are virus free and have perfect security? If it's open source, you can check the code, vibe coded or not (I doubt the majority does). If it's a commercial app, the developer(s) probably care more about making money than writing the "perfectly secure" app, vibe coded or not.
BorisMelnik
depends on the source, but if it is open source and someone I trust I suppose the same amount of suspiciousness asa non vibe coded app?
reureu
I'm hesitant to, but more because it seems that many vibe coded apps* that I've come across have a week's worth of commits and no activity for the past 2-3 weeks. I have trouble imagining somebody who one-shotted an app is going to support that app for any reasonable lifespan. And, to your point, not only am I concerned about longevity of the app, but security and data harvesting concerns are also there. *"vibe coded apps" in this context are ones whose description is full of emojis, the repo is in somebody's recently created personal GitHub account, and where there are likely already other apps addressing the same or similar use cases.
vegnus
I would ask why they chose for it to need to be installed, rather than just delivering some web application
officeplant
I'm hesitant to even use Linux due to vibe coding bleeding into the kernel.
al_borland
I avoid them. Some look cool, and might even be useful… but is there something lurking in the code the developer doesn’t even know about? Will it get support? Was there any thought or care when it comes to security? How long before the developer moves on to their next vibe coded project… an hour? The only pure vibe coded apps on my computer (that I’m aware of), are ones I made myself.
xyzsparetimexyz
Lindy's law applies here: https://en.wikipedia.org/wiki/Lindy_effect I'm not going to install vibecoded Photoshop when gimp exists.
bill10
It is not vibe-coded or not, but who vibe-coded it, and what do others say about, like the stars on github.