A founder vibe-coded his entire SaaS with AI. Hackers found API keys in the frontend and stole $87,500.

Came across this real incident — a founder used Claude Code to build and ship his startup. No security review, no tests. Hackers found Stripe API keys exposed in the client-side JavaScript and charged 175 customers $500 each.

  The fix would have been one line in the AI prompt: "Never expose API keys in client-side code."

  Full breakdown of what went wrong + a live demo that runs 28 actual Playwright security tests against a replica of the vulnerable app:

  https://qualitymax.io/vibe-check

  What security gaps have you seen in AI-generated code?