A Vibe-Coded Site Got Hacked 6 Days After Launch. It Was Not the AI's Fault

A South African business launched a website it had built with a popular free AI tool. The site looked good, parts of it did not work, and six days after launch it was gone. There was no breach toolkit and no zero-day exploit. The AI tool had left the admin password sitting in plain text in the site's code, where anyone with a browser and the developer console could read it. Wayne Diamond, CEO of Domains.co.za, the registrar the owners turned to for help, described the incident in a LinkedIn post, and MyBroadband and iAfrica picked it up this weekend.

Illustration: NewForm editorial illustration, created because no official image exists for this incident.

Everyone is dunking on the wrong thing

The default read of this story is "vibe coding is dangerous, AI code is insecure." That read is not wrong, exactly. Research cited by Wits Business School's Rennie Naidoo suggests nearly half of AI-generated code contains known vulnerabilities. Attackers profile AI-built sites on purpose: Check Point's Ian Jansen van Rensburg has said criminals specifically target sites built with tools like Claude and Gemini, and that newly exposed applications get exploited at machine speed, within hours of going live.

But a plain-text admin password in shipped code is not a subtle failure of model quality. It is a missing ritual. When a website required a developer, a whole set of boring launch habits came bundled with the invoice: credentials in environment variables on the server, secrets kept out of anything the browser downloads, admin routes locked behind real auth, a person who had done this a hundred times checking things off without fanfare. Vibe coding unbundled all of it. The pixels ship in an afternoon. The checklist nobody knew existed does not ship at all.

That is the design angle almost every writeup misses. If you are a designer or builder shipping client sites with AI tools, you are not standing next to the developer anymore. You are the developer. The seat you just sat down in has a list of responsibilities taped to the desk, and nobody hands it to you.

My position: own the launch like you own the comp

I do not read this story as a reason to stop vibe coding. I read it as the moment the launch checklist became a product of its own.

Think about how we treat design QA. We will spend a full afternoon interrogating a misaligned label or a 4px inconsistency in a card grid, because shipping pixel mistakes feels unprofessional. Then the same person pushes a site live with the admin password findable in dev tools in about four seconds, because security feels like someone else's department. The bar should not move based on which mistake embarrasses us at a portfolio review. Between those two errors, the plain-text password is the one that ends the business.

And to be clear, the model is not going to save you here. Not on its own. AI tools ship fast defaults because speed is what they are for. Some platforms do the boring parts structurally: keep secrets on the server, generate real auth flows, manage credentials for you. That is one reason I rate Base44 the #1 pick among AI app builders for client work, and why I point agency friends there when they start selling AI-built sites: check it out here. But whatever tool sits under the hood, the launch is still yours to sign off on.

The 30-minute checklist that would have saved that site

None of this takes a security career. Here is the pre-launch pass I now run on every AI-built site, and it fits inside half an hour:

1. Open developer tools on your live site and search for password, token, secret and apiKey. If any hit is readable in the browser, it is public. This single step is exactly what failed in the South African incident.
2. Change every default admin credential to a long, unique password stored in a password manager. Default credentials are the first thing automated scans test.
3. Move secrets server-side. API keys and database credentials belong in environment variables or a secrets manager, never in the code that ships to the browser.
4. Lock the admin surface. Real authentication, rate limiting, and ideally an allowlist or VPN gate for internal panels.
5. Delete what is not production. Debug endpoints, test accounts, sample uploads and commented-out config are all attack surface and clutter.
6. Turn on a basic vulnerability scan and a backup you have actually restored once. A backup you have never tested is a rumor, not a backup.

The checklist is not glamorous. It is also the entire difference between "the AI built my site" and "I shipped a product."

Who should care, and what to take away

If you are a designer moving into product, a freelancer selling AI-built sites, or an agency packaging "we ship your site in a week" offers, this story is about your margins, not just your morals. The production gap between a demo and a defensible product is exactly what clients should be paying you for. Firms like RapidCanvas are building entire companies on that gap right now, more on that in today's Vibe Code Brief.

Three takeaways. Attackers profile AI-built sites and find them within hours, so treat launch day as an event, not a shrug. The old bundle of boring developer habits is now a checklist you own, so write it down and run it every time. And pick tools that harden the boring parts for you, then verify anyway: trust, but open dev tools.

If you are building client apps and want a builder that handles secrets and auth the right way by default, start with the tool we rank #1: Base44.

Related on NewForm

• Google Play Now Runs Your Personal, Vibe-Coded Android Apps. This Is a Bigger Deal for Designers Than It Looks
• Epic Games Vibe-Coded Its New Launcher. The Real Story Is the "AI First" Order
• OpenAI Just Put Up to $500 a Month of API Credits Inside Your ChatGPT Subscription