Vibe-coded CRM, first security test: anyone could read the client data

What we’ve seen. A CRM built by vibe coding: someone describes what they want and an AI writes the code. It comes together in days and everything looks fine on screen.

Then comes the first security test. Anyone could retrieve client and product data. Nothing was visibly broken and no error showed up. The app simply handed the data to whoever asked.

The real cause

The AI built what was asked: a CRM that works. Nobody asked for it to be secure, and it didn’t think about who else could ask. Security is not a default of generated code. A human has to require it and check it.

What it cost

About two days of work, spent on testing and on choosing the right tools to close the gaps. Days that would not have been needed if security had been a requirement from the first prompt instead of an afterthought.

What fixes it

• Close the access. Data is only reachable through controlled, server-side access, never directly from the page.
• Add a bot check on forms, for example Cloudflare Turnstile.
• Test as a stranger. Nothing goes live until a human has tried to get in without credentials.

Takeaway: if an app works, it hasn’t been tested. Try it as a stranger before you trust it with client data.

Want to know if your CRM has this kind of gap? The 5-minute diagnostic shows where your tools, data and automations stand.

Read next: The AI built the lead scoring. Nobody can say why a lead is a 78 · 20 ghost contacts named x***xx: what happens when AI writes to a CRM with no framework