Hu Yanbin's App Got Picked Apart, AI Patched the Security Back—A Pre-Launch Security Audit Handbook for People Who Don't Code

Hu Yanbin built an app, and I think that’s pretty impressive.

But there’s an article going around these past couple of days with enormous traffic, written by a senior engineer formerly at NetEase. Its surface tone is “I’m about to lose my job, I’m going to be replaced by AI, look, even a celebrity can go write an app now”—but really, the whole piece is a sour, item-by-item takedown of every security problem in Hu Yanbin’s app.

I think the sourness was unnecessary.

I understand how programmers feel, but this is where we are

A close friend of mine has a PhD in natural language processing and computer science. He’s rueful about it too—that his 20-plus years of hand-coding may really be going from the leading edge of technology to “a bearer of intangible cultural heritage.” We joke that hand-coding the old way is about to become a lost art.

I completely understand how programmers feel about this. But this is where we are: an app built by an expert who understands the business genuinely does fit user needs better. No question it’ll have some security problems—but those problems are entirely solvable with AI right now.

So this episode is about closing as many of the security holes that blogger raised as we can, using Claude Code. If you’re an expert in some industry too, and you’re building your own app or software with Claude Code or vibe coding, this one is worth watching.

Handing the article to Claude Code

I copied the entire contents of that WeChat article, pasted it into Claude Code, and said roughly one paragraph:

This article is a technical expert griping about a celebrity developing his own software and all the security problems in it. I think the problems he raises are pretty reasonable, and those of us doing vibe coding hit them often. Could you read it and then spin up a multi-agent team to collect, as comprehensively as possible, the security problems a software MVP might run into after launch, and list them out—so that those of us who don’t understand code at all can still do the most basic security checks. Make the list as complete as you can during the research phase, and present it as a web page. Don’t just list the problems—list the industry’s current best-practice fixes for each one too, and turn the whole thing into a little handbook we can give our audience.

It read the article first. It pulled out a few areas—SMS flooding, no moderation on user avatars—and that whole class of problem is real. But by comparison, patching it with AI is easy.

An aside: will programming become a heritage craft?

While I waited for the result, I thought of a scene from The Matrix. In Zion, the humans’ underground city of survivors, an elder stands at the center pointing at an enormous machine that has run for who knows how many years. Nobody down there, he tells Neo, knows how it works anymore.

It didn’t land at the time. Thinking it through today, in the age of AI, code is already all written by AI, and AI is already self-iterating using AI—like the Opus 4.8 we’re seeing now, self-iterating with its own model. A few more years and there may genuinely be nobody who understands programming, nobody who understands why this model can do what it does—or only a handful of people. When that day arrives, the entire system we depend on to live, even the robots in every household, will have something at its core that no single person can fully understand or fully control. Which is honestly a frightening thought.

What the handbook it produced looks like

Fast-forward. The result comes out, and you open the page: this is the security self-audit checklist built for MVP products made by people who don’t code, 88 items across 12 major security domains.

It starts by listing the five failure points the blog author said Hu Yanbin got wrong, and what caused each one; then the eight things you must have done before launch—including ICP filing, payment-related issues, WeChat login issues, and so on. Then it works through 12 domains, sorting problems into critical, high, medium, and low.

Look at the first domain—authentication and account security. It lists the pile of problems that can show up there, and every item spells out: exactly where it breaks, what the possible consequences are, how to test for it yourself, what the correct approach should be, and what tools and services you can use. And most importantly, you can copy a prompt in one click and hand it straight to your own agent to go check and fix that problem. Every problem comes with that whole package of explanation. That’s all there is to it.

Another example: broken access control—object storage running wide open, where anyone with the URL can download and open things; sensitive files that can be bulk-downloaded through an API. What the problem is, what it could cause, how to test whether you have it, what the correct approach is, how to tell the AI to go check—it’s all in there. Further on there’s UGC content safety and moderation, file uploads and image hosting, interface and API security, injection and frontend security, and more.

How to use it

All I have to do is hand a page like this to Claude Code (or Codex, that works too), have it check the production-grade service I’m about to put in front of people against the list, then draw up a fix plan—and that takes care of 80%, even 90% of it.

If you’re genuinely launching a production-grade product that thousands or even tens of thousands of users will touch, a security check like this is non-negotiable.

And the author of that article had no reason to be that sour. The whole thing reads like “here’s a good suggestion for you, this broke, you should fix that,” but between the lines it’s dripping with a senior engineer’s sense of superiority.

The page I just built is up on the site, and anyone can download it for free.

Last thing I want to say: professionals in every industry need to start learning vibe coding now. If you have the leading insight and experience in some industry, you can build a genuinely great product with vibe coding off your understanding of that industry and certain specific situations—and it will beat what the people who only understand the tech can build.

See you next episode.

Source: EP0027_audio.mp3 · ASR model gemini-2.5-pro (chunked parallel) · full text of the roughly 8-minute original recording

[00:00] Hu Yanbin built an app, and I think that’s a seriously impressive thing. But this one article has been getting a ton of traffic. A former senior technical expert at NetEase wrote a piece, and on the surface it says I’m about to lose my job, I’m going to be replaced by AI, look, even a celebrity can write an app now. But what the piece actually does is use really sour language to lay out every security problem in the app Hu Yanbin built. There was really no need for that. I mean, I completely understand—

[00:25] how programmers feel. Because I have a really good friend who’s a PhD in natural language—natural machine science—and he’s been feeling the same way, that his twenty-odd years of writing code by hand might actually take him from being out in front of the technology to being, what do you call it, a bearer of intangible cultural heritage. We joke about it: ancient-method programming is about to be a lost art, right? So I completely understand how that group of programmers feels. But the reality right now is exactly this: when a domain—

[00:51] expert builds the app themselves, it genuinely does fit user needs better. But there’s no denying there really are some security problems. Except those security problems can be fixed with AI right now too. So that’s what we’re talking about today: the security holes this blogger raised, and how we use Claude Code to avoid as many of them as possible. If you’re also a domain expert and you’re using CC, or vibe coding, to build your—

[01:16] own apps, your own software, then this episode is for you. So first let’s look—we take this WeChat article, which is just dripping with sour grapes, and the comments under it are full of programmers saying, no, actually we can’t be replaced, and look at those clueless newbies so happy about it. I’ve got nothing to say to that either. So let’s go to the WeChat article and copy the entire contents. I go into Claude Code and paste it.

[01:41] And all I need to say is: this article is a technical expert griping about all the various security problems in software a celebrity developed himself. I want you to read the whole article for me and look at the problems raised in it, because I think the problems he’s raising are pretty legitimate. And those of us doing web coding run into problems like these all the time. So the thing I’ve been thinking about is:

[02:06] once you’ve read this article, could you spin up a multi-agent team, and let’s round up, as completely as we can, all the security problems you might hit after shipping an MVP version of a piece of software. Let’s put them in a checklist, so that checklist can help those of us out here web coding who don’t understand code at all do the most basic—

[02:31] security checks. And this checklist—I need you to make it as complete as possible during the exploration and research phase, and then present it as a web page. And don’t just list the problems; also list the current industry best-practice solution for each one. Let’s turn this into a little handbook and give it to our followers, okay? Right—so it’s just having my Claude Code—

[02:56] read the article and look at roughly which areas it raises, including the SMS bombing thing, including no moderation on user avatars, that whole set of problems. Those problems really do exist. But patching them with AI is pretty easy, relatively speaking. And these last couple of days—actually this morning when I got up I was still turning over one question, because I’d heard about—

[03:22] The Matrix, that movie, I don’t know if you’ve seen it. There’s a shot in it where Neo, the movie’s protagonist, is in the heart of Zion, the underground city of the human survivors, and one of the city’s—call him an elder, or a council member—points at that giant machine and tells Neo: look, this machine has been running for who knows how many years, and at this point nobody knows how it works anymore.

[03:48] Honestly, when I watched it back then it didn’t hit me this hard. But when you really think it through today, now that AI is here—all the code gets written by AI now, right? And AI is already using AI to iterate. The Opus 4.8 model we’re looking at right now was iterated on by its own model. So in a situation like that, programming really might become an item of intangible cultural heritage.

[04:13] And then some years down the road nobody understands programming, nobody understands why this model can do what it does today—or only a tiny handful of people know. So one day, when that day comes, the entire system we humans depend on to live, even the robots inside every household—their most core parts are going to be something a human can’t fully—

[04:38] understand or control. That’s the situation we’re heading for. And that’s a pretty scary thing too. Okay, let’s fast-forward, fast-forward through this part, and I’ll show you once the result is out. All right, it’s done now. Let’s open the web page and take a look. It’s gone and built what I asked for—the security checklist you need to run through for these MVP products built by web coders who—

[05:03] don’t understand code. It listed 88 items across 12 major security areas. Really all we have to do is throw this web page at Claude Code, or Codex, and let its agents run a rigorous checklist-style audit against the software we’ve written and draft a fix plan. That’s it. Odds are this whole problem is completely fixable. Let’s look at what’s in here.

[05:29] First it lays out the five failure points where, according to the blog post’s author, Hu Yanbin went wrong, and what kind of problem caused each. And then we’ve got the eight things you absolutely must do before launch, including ICP filing, including some payment-related issues, including the WeChat login issue, and so on. Then next it looked across 12 areas and sorted things into critical, high-risk, medium-risk, and low-risk. So let’s look at the—

[05:55] whole thing. The first one is authentication and account security. Within that one area, look how many possible problems it lists. And for each, where exactly things blow up, what the consequences might be, including how to test it yourself, what the recommended correct approach is, what tools and services you can use—you can see all of it in here, how the problem gets solved. And likewise you can one-click copy the prompt—

[06:20] and hand it to your own agent to check and fix that problem. Every problem has that whole set of explanations. It’s that simple. Look, like broken access control—every possible problem in there, for instance object storage sitting wide open, where anyone with the URL can download and open it. What kind of problem is that, what consequences could it cause? Or bulk downloading sensitive files through the API. How do you test whether you have that problem, and what’s the correct approach? Including how to tell the AI—

[06:46] to go check for that problem of yours. It’s all in here. Including UGC content safety and moderation, file upload and image-host issues, interface and API security issues, injection and frontend security issues. I really only have to hand a web page like this to Claude Code and have it check the production-grade service I’m about to put out there, and this whole thing is basically 80%, even 90%, solved. And if you’re genuinely shipping something that might have tens of thousands—

[07:12] or forget tens of thousands, even a few thousand users on it, a production-grade product, then a security check like this is a must too. So I think this author really didn’t need to go there. I mean, this piece, the whole piece, on the surface it’s going, oh, let me give you some good advice, hey Hu Yanbin, you’ve got a problem here, you should patch that over there. But between the lines it’s all leaking that sense of—

[07:37] superiority as a senior technical person. Anyway, I got a very strong feeling of that. So he—how do I put it—ah, I’ll leave it there. You can go take a look, go to the site and look at the web page I just made, it’s all free to download. So all you professionals across every industry—you have to start learning vibe coding right now. Because right now, as long as you have any—

[08:02] of the most cutting-edge understanding and experience in an industry, you can take it and, through vibe coding, on the strength of what you know about that industry and about certain specific situations in it, turn it into a genuinely great product. And it’s definitely going to be better than what people who only understand the tech build, okay? So, see you next episode. That’s it for today, bye-bye.