Hu Yanbin's App Got Picked Apart, AI Patched the Security Back — A Pre-Launch Security Audit Handbook for People Who Don't Code

Hu Yanbin built an app, and I think that’s pretty impressive.

But there’s an article going around these past couple of days with enormous traffic, written by a senior engineer formerly at NetEase. Its surface tone is “I’m about to lose my job, I’m going to be replaced by AI, look, even a celebrity can go write an app now” — but in practice, the whole piece uses very sour language to pick apart every security problem in Hu Yanbin’s app, one by one.

I think the sourness was unnecessary.

I understand how programmers feel, but this is where we are

I have a very close friend with a PhD in natural language processing and computer science. He’s rueful about it too — that his 20-plus years of hand-coding may really be going from a position at the leading edge of technology to being “a bearer of intangible cultural heritage.” We joke that hand-coding the old way is about to become a lost art.

I completely understand how programmers feel about this. But this is where we are: an app built by an expert who understands the business genuinely does fit user needs better. There’s no denying it’ll have some security problems — but those problems can be entirely solved with AI right now.

So this episode is about using Claude Code to close as many of the security holes that blogger raised as we can. If you’re an expert in some industry too, and you’re building your own app or software with Claude Code or vibe coding, this one is worth watching.

Handing the article to Claude Code

I copied the entire contents of that WeChat article, pasted it into Claude Code, and said roughly one paragraph:

This article is a technical expert griping about a celebrity developing his own software and all the security problems in it. I think the problems he raises are pretty reasonable, and those of us doing vibe coding hit them often. Could you read it and then spin up a multi-agent team to collect, as comprehensively as possible, the security problems a software MVP might run into after launch, and list them out — so that those of us who don’t understand code at all can still do the most basic security checks. Make the list as complete as you can during the research phase, and present it as a web page; don’t just list the problems, list the industry’s current best-practice solutions to them as well, and make it a little handbook to give to our audience.

It read the article first. It mentioned a few areas — SMS flooding, no moderation on user avatars — and that whole class of problem is real. But relatively speaking, patching it with AI is also very easy.

An aside: will programming become a heritage craft?

While I waited for the result, I thought of a scene from The Matrix: in Zion — the humans’ underground city of survivors — at the center, an elder points at an enormous machine that has been running for who knows how many years and tells Neo that none of them know how it actually works anymore.

It didn’t land at the time. Thinking it through today, in the age of AI, code is already all written by AI, and AI is already self-iterating using AI — like the Opus 4.8 we’re seeing now, self-iterating with its own model. A few more years and there may genuinely be nobody who understands programming, nobody who understands why this model can do what it does, or only a very small number of people. When that day arrives, the entire system we depend on to live, even the robots in every household, will have at their core something no single person can fully understand or fully control — which is honestly a rather frightening thing.

What the handbook it produced looks like

Fast-forward. The result comes out, and you open the page: this is the security self-audit checklist built for MVP products made by people who don’t code, 88 items across 12 major security domains.

It starts by listing the five failure points the blog author said Hu Yanbin got wrong, and what caused each one; then the eight things you must have done before launch — including ICP filing, payment-related issues, WeChat login issues, and so on. Then it works through 12 domains, sorting problems into critical, high, medium, and low.

Look at the first domain — authentication and account security. It lists the pile of problems that can show up in that domain, and every item spells out: exactly where it breaks, what the possible consequences are, how to test for it yourself, what the correct approach should be, and what tools and services you can use. And most importantly, you can copy a prompt in one click and hand it straight to your own agent to go check and fix that problem. Every problem comes with that whole package of explanation. That’s all there is to it.

Another example: broken access control — object storage running wide open, where anyone with the URL can download and open things; sensitive files that can be bulk-downloaded through an API. What the problem is, what it could cause, how to test whether you have it, what the correct approach is, how to tell the AI to go check — it’s all in there. Further on there’s UGC content safety and moderation, file uploads and image hosting, interface and API security, injection and frontend security, and more.

How to use it

All I actually need to do is hand a page like this to Claude Code (or Codex, that works too), have it check the production-grade service I’m about to put in front of people against it, then draw up a fix plan — and that basically resolves 80%, even 90% of it.

If you’re genuinely launching a production-grade product that thousands or even tens of thousands of users will touch, a security check like this is non-negotiable.

As for that article’s author, I think the sourness was completely unnecessary — the whole thing reads like “here’s a good suggestion for you, this broke, you should fix that,” but between the lines, it’s dripping with a senior engineer’s sense of superiority.

The page I just built is up on the site, and anyone can download it for free.

Last thing I want to say: professionals in every industry need to start learning vibe coding now. If you have the leading insight and experience in some industry, you can build a genuinely great product with vibe coding off your understanding of that industry and certain specific situations — and it will beat what the people who only understand the tech can build.

See you next episode.

Source: EP0027_audio.mp3 · ASR model gemini-2.5-pro (chunked parallel) · full text of the roughly 8-minute original recording

[00:00] Hu Yanbin built an app, and I think that’s a seriously impressive thing. But this one article has been getting a ton of traffic. A former senior technical expert at NetEase wrote a piece, and on the surface it says I’m about to lose my job, I’m going to be replaced by AI, look, even a celebrity can write an app now. But what the piece actually does is use very sour language to lay out every security problem in the app Hu Yanbin built. I don’t think there was any need for that. I mean, I completely understand —

[00:25] how programmers feel. Because I have a really good friend who’s a PhD in natural language — natural machine science — and he too has been reflecting that his twenty-odd years of hand-writing code might really take him from being at the front of technology to being what you’d call an intangible-heritage bearer. We joke about it: ancient-method programming is about to be a lost art, right? So I completely understand how that group of programmers feels. But the reality right now is exactly this: when a domain —

[00:51] expert builds the app themselves, it genuinely does fit user needs better. But there’s no denying there really are some security problems. Except those security problems can also be solved with AI right now. So that’s what we’re talking about today: the security holes this blogger raised, and how we use Claude Code to avoid as many of them as possible. If you’re also a domain expert and you’re using CC, or vibe coding, to build your —

[01:16] own apps, your own software, then this episode is for you. So first let’s look — we take this WeChat article, which is just brimming with sourness, and the comments under it are also full of programmers saying, actually we can’t be replaced, and look at those clueless newbies being all happy about it. I’ve got nothing to say to that either. So let’s go to the WeChat article and copy the entire contents. I go into Claude Code and paste it.

[01:41] And all I need to say is: this article is a technical expert griping about all the various security problems in software a celebrity developed himself. I want you to read the whole article for me and look at the problems raised in it, because I think the problems he’s raising are pretty legitimate. And those of us doing web coding run into problems like these all the time. So the thing I’ve been thinking about is:

[02:06] after you finish reading this article, could you spin up a multi-agent team, and let’s collect as comprehensively as possible all the security problems you might hit after shipping an MVP version of a piece of software. Let’s put them in a checklist, so that checklist can help those of us who are web coding with zero understanding of code do the most basic —

[02:31] security checks. And this checklist — I need you to make it as complete as possible during the exploration and research phase, and then present it as a web page. And don’t just list the problems; also list the current industry best-practice solution for each one. Let’s turn this into a little handbook and give it to our followers, okay? Right — so it’s just having my Claude Code —

[02:56] read the article and look at roughly which areas it raises, including the SMS bombing thing, including no moderation on user avatars, that whole set of problems. Those problems really do exist. But relatively speaking, using AI to patch them is also very easy. And these last couple of days — actually this morning when I got up I was still turning over one question, because I’d heard about —

[03:22] The Matrix, that movie, I don’t know if you’ve seen it. There’s a shot in it where Neo, the movie’s protagonist, is in the heart of Zion, the underground city of the human survivors, and one of the city’s — call him an elder, or a council member — points at that giant machine and tells Neo: look, this machine has been running for who knows how many years, and at this point nobody knows how it works anymore.

[03:48] Honestly, when I watched it back then it didn’t hit me this deeply. But think it through carefully today, in this era of AI arriving — all the code now is written by AI, right? And AI is already using AI to iterate. The Opus 4.8 model we’re looking at now was self-iterated using its own large model. So in a situation like that, programming really might become an item of intangible cultural heritage.

[04:13] And then some years down the road nobody understands programming, nobody understands why this model can do what it does today — or only a tiny handful of people know. So one day, when that day comes, the entire system we humans depend on to live, even the robots inside every household — their most core parts are going to be something a human can’t fully —

[04:38] understand or control. That scenario is going to show up. And that’s a pretty scary thing too. Okay, let’s fast-forward, fast-forward through this part, and I’ll show you once the result is out. All right, it’s done now. Let’s open the web page and take a look. It’s now built, per my ask, the security checklist you need to run through for these MVP products built by web coders who —

[05:03] don’t understand code. It listed 88 items across 12 major security areas. Really all we have to do is throw this web page at Claude Code, or Codex, and let its agents run a rigorous checklist-style audit against the software we’ve written and draft a remediation plan. That’s it. This problem is very likely completely solvable. Let’s look at what’s in here.

[05:29] First it lays out the five failure points where, according to the blog post’s author, Hu Yanbin went wrong, and what kind of problem caused each. And then we’ve got the eight things you absolutely must do before launch, including ICP filing, including some payment-related issues, including the WeChat login issue, and so on. Then next it looked across 12 areas and sorted things into critical, high-risk, medium-risk, and low-risk. So let’s look at the —

[05:55] whole thing. The first one is authentication and account security. Within that one area, look how many possible problems it lists. And for each, where exactly things blow up, what the consequences might be, including how to test it yourself, what the recommended correct approach is, what tools and services you can use — you can see all of it in here, how the problem gets solved. And likewise you can one-click copy the prompt —

[06:20] and hand it to your own agent to check and fix that problem. Every problem has that whole set of explanations. It’s that simple. Look, like broken access control — every possible problem in there, for instance object storage sitting wide open, where anyone with the URL can download and open it. What kind of problem is that, what consequences could it cause? Or bulk downloading sensitive files through the API. How do you test whether you have that problem, and what’s the correct approach? Including how to tell the AI —

[06:46] to go check for that problem of yours. It’s all in here. Including UGC content safety and moderation, file upload and image-host issues, interface and API security issues, injection and frontend security issues. I really only have to hand a web page like this to Claude Code and have it check the production-grade service I’m about to put out there, and this whole thing is basically 80%, even 90%, solved. And if you’re genuinely shipping something that might have tens of thousands —

[07:12] or forget tens of thousands, a few thousand users using it, a production-grade product, then a security check like this is also indispensable. So I think this author really didn’t need to do that. I mean, this piece, the whole piece, on the surface it’s going, oh, let me give you some good advice, hey Hu Yanbin, you’ve got a problem here, you should patch that over there. But between the lines it’s all leaking that sense of —

[07:37] superiority as a senior technical person. Anyway, I got a very strong feeling of that. So he — how do I put it — ah, I’ll leave it there. You can go take a look, go to the site and look at the web page I just made, it’s all free to download. So all you professionals across every industry — you have to start learning vibe coding right now. Because right now, as long as you have any —

[08:02] of the most leading-edge understanding and experience in an industry, you can take it and, through vibe coding, on the strength of your understanding of that industry and of certain specific scenarios, turn it into a genuinely great product. And it’s definitely going to be better than what people who only understand the tech build, okay? So, see you next episode. That’s it for today, bye-bye.