This is why you can't blindly use AI

Become a YT Members to get extra perks!

My Products

Useful Links

[WebDevCody]

btw, someone could have also pasted in a projectId=example.com# and the # would have ignored everything past the domain they provided. They could have also doing projectId=example.com/ and it would have treated the convex .site as a sub path on their own service. Basically, sanitize your inputs. dumb mistake. shout out to the guy who emailed me the info 🙌

[seancooper]

Wow, AI is a massive security risk; who'd have thought…

[erikslorenz]

The CEO of Nvidia told me I should though.

[LiveType]

Classic client side validation error. Error here: assuming the client is always sending valid input.

Happens to the best of us. Especially when not paying attention thinking it's not a "serious" service.

Source: Nasty cascading privilege escalation exploit from said client side validation. The type of mistake you only make once.

[technologic]

what a good time to do bug bounty hunting

[lazyprog]

good thing you found out about it quickly

[doc]

Imagine hackers intentionally create huge amount of obscure codes with security hole with some seo, and AI model trained with those codes.

[StevenAkinyemi]

Need a code security reviewer AI to double check our coder AI

[paulroque]

I am really starting to appreciate this Cody guy. He is not afraid of being honest and going back on the hyped stuff he tries. I love that.

[alexandrecolautoneto]

NOOO, Please don't ask AI to review the code generated by AI. If you are saving your time writing the code, take your time to review the code, and do it carefully. Don't take all the AI shortcuts, the code will be crap!

[ahsanmasood]

Finally someone is talking about it. All those people going bonkers on how they created "SaaS" with AI, never bought that crap.

[Steel]

Do you think it can train itself over our .env variable values? I have been thinking about this now-a-days

[mmzzzmeemee]

I think the proper way to write code with AI is pretty similar to how we write code normally.

Copy changes incrementally, test the code changes, then make changes as necessary.
I have to admit tho it's pretty tempting to just make AI do all of the unfun stuff where you're in a hurry, fell into that trap as well

[TheJort]

3:35 Wait, it's a side project yet you're just trying to ship stuff? How does that work

[aiamfree]

am I missing something or can you not have allowed origins fix this globally… edit nevermind I just saw the part for alloweddomains

[valhalla_dev]

huge props for being transparent about this. this is a super easy (and unfortunately common) type of bug, and will only be more common as AI is leaned on more and more heavily

[Imjoshnewton]

I will say this seems more like a code review and checking issue and doesn’t really have to do with AI too much. If you had learned this GO from googling, would you have caught that it had a security issue? I’m not sure that it coming from an LLM is the major issue. All really good points and steps to follow though!

[muhammedmaher]

I've just become addicted to your videos! Great one as usual. 🔥

[frowin]

These kind of videos are so valuable. Please make more of them!

[randomlettersqzkebkw]

but wait man.. that architecture is highly sketchy tho. With or without ai