Written with AI assistance from the source video. The video is the authority.
Log in to leave a comment
No posts yet
A non-developer employee comes in with an impressive web app built in just three days using vibe-coding tools like v0 or Cursor. The CEO gets thrilled and suggests immediately hooking it up to the production DB so customers can start using it. At that moment, the developers or the CTO break into a cold sweat. Looking at the AI-generated code reveals database connection strings (DSNs) hardcoded right in the middle of client components, or SQL queries being executed without a single shred of input validation.
Deploying this straight to the production server is a disaster waiting to happen. The OWASP Top 10 for LLM Applications 2025 report explicitly highlights Excessive Agency (LLM06) and Improper Input Handling (LLM05) in AI-generated code as top security threats. In fact, 73% of web application security breaches target the lack of input validation.
To safeguard your company's database without crushing the productivity of non-developers, you need to establish a solid control layer between the prototype and the database.
The first thing to do is block the path so the app built by the non-developer cannot call the database directly. Set up Next.js App Router's server route handlers as a proxy, and validate incoming data in real time using the Zod library in between. TypeScript's type checking only works during development; it won't prevent the server from crashing when actual users send malformed data.
| Validation Item | Browser UI-Side Validation | Server-Side Zod Proxy Layer |
|---|---|---|
| Execution Location | Customer Browser | Vercel Serverless Runtime |
| Security | Easily bypassed via Developer Tools | Enforced on the server to protect the DB |
| Data Validation | Basic text checks | Precise runtime range and type validation |
| Failure Handling | Display warning messages on screen | Return HTTP 400 and log Sentry errors |
The implementation steps are straightforward:
app/api/v1/customer-records/route.ts file in your project.companyName requiring at least 2 characters, contactEmail following an email format, and employeeCount accepting only positive integers.request.json() using schema.parse(). Insert only the validated payload into the DB using Prisma ORM; if validation fails, reject it on the spot with a 400 error.Along with app-level validation, you must also set up defenses at the database level itself. If you're using PostgreSQL-based Supabase, setting up Row Level Security (RLS) is the way to go. Place user role information into raw_app_meta_data—which only administrators can tamper with—instead of raw_user_meta_data (which users can manipulate), and validate the JWT.
`sql
-- 1. Enable RLS on the table
ALTER TABLE public.enterprise_documents ENABLE ROW LEVEL SECURITY;
-- 2. Create a function to extract the user role from the JWT
CREATE OR REPLACE FUNCTION get_user_role()
RETURNS text AS
LANGUAGE sql STABLE;
-- 3. Policy that allows access only if the department matches or the user is an admin
CREATE POLICY "Department Access Policy" ON public.enterprise_documents
FOR SELECT USING (
get_user_role() = 'admin' OR
department = (current_setting('request.jwt.claims', true)::json->'app_metadata'->>'department')
);
`
By taking these steps, even if a non-developer accidentally leaks a Service Role Key in the code, sensitive documents from other departments will never be exposed.
AI tools are primarily designed to focus on getting a UI up and running quickly, so they often slap API keys or DB connection strings right where they get exposed to the browser. The most frequent mistake is indiscriminately appending the NEXT_PUBLIC_ prefix. In Next.js, variables with this prefix are included as plain text in the browser's JavaScript files. The moment a variable like NEXT_PUBLIC_OPENAI_API_KEY is created, anyone who knows how to open F12 Developer Tools can grab your API key and use it to their heart's content.
Look no further than the security breach on Vercel infrastructure in April 2026. Unprotected environment variables were exposed when permissions for an integrated third-party AI tool were compromised, forcing countless teams to pull all-nighters reissuing DB passwords and API keys one by one.
It is impossible for humans to manually inspect these mistakes line by line. You need to attach the Gitleaks static analysis tool to GitHub Actions to automatically purge them before code gets merged.
`yaml
name: Security Scan
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
jobs:
gitleaks-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install and Run Gitleaks
run: |
wget https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
tar -xzvf gitleaks_8.18.0_linux_x64.tar.gz
sudo mv gitleaks /usr/local/bin/
gitleaks detect --source=. --verbose --redact --exit-code=1
public-env-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check Unsafe Public Keys
run: |
UNSAFE=(grep -rn "NEXT_PUBLIC_.*\(SECRET\|KEY\|PASSWORD\|TOKEN\|DSN\)" . || true)
if [ -n "UNSAFE" ]; then
echo "Sensitive variables exposed to client found:"
echo "$UNSAFE"
exit 1
fi
`
With this pipeline configured, the moment a non-developer pushes code containing API keys in the source code or in NEXT_PUBLIC_ variables, deployment will be automatically blocked.
When registering variables in the Vercel dashboard, make sure to clearly separate Development, Preview, and Production scopes. In particular, be sure to enable the Sensitive Environment Variable checkbox. This encrypts the value so that it isn't output in build logs and cannot be copied as plain text from the dashboard.
When OpenAI or Anthropic servers crash or experience delays, all serverless handlers fall into a waiting state, causing cascading failures. In such cases, you should implement a circuit breaker using Node.js's opossum library.
`typescript
import CircuitBreaker from 'opossum';
async function callLLM(prompt: string) {
// LLM API call logic
}
const options = {
timeout: 5000, // Treat as failure if it exceeds 5 seconds
errorThresholdPercentage: 50, // Open breaker if failure rate exceeds 50%
resetTimeout: 30000 // Retry after 30 seconds
};
const breaker = new CircuitBreaker(callLLM, options);
breaker.fallback(() => ({ error: "AI response is delayed. Please try again in a moment." }));
`
When API responses are delayed, sending a pre-configured message within 0.1 seconds prevents the entire service from going down.
You should also connect Sentry and Slack webhooks so that non-developer creators can immediately know when an incident occurs.
`typescript
// app/api/webhooks/sentry-to-slack/route.ts
import { NextResponse } from 'next/server';
export async function POST(request: Request) {
try {
const event = await request.json();
const webhookUrl = process.env.SLACK_INCOMING_WEBHOOK_URL;
if (!webhookUrl) return NextResponse.json({ error: 'No webhook URL' }, { status: 500 });
const title = event.data?.issue?.title || 'Unknown system error';
const issueUrl = event.data?.issue?.permalink || '#';
await fetch(webhookUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
blocks: [
{
type: 'header',
text: { type: 'plain_text', text: '🚨 Production Error Occurred' }
},
{
type: 'section',
text: { type: 'mrkdwn', text: `*Error Details:*
${title}` }
},
{
type: 'actions',
elements: [
{
type: 'button',
text: { type: 'plain_text', text: 'View Sentry Report' },
url: issueUrl,
style: 'danger'
}
]
}
]
})
});
return NextResponse.json({ success: true });
} catch (err) {
return NextResponse.json({ error: 'Webhook failed' }, { status: 500 });
}
}
`
If a P1-level incident breaks the main page as errors escalate, there is no need to wait for developers. Vercel keeps previous deployments intact, allowing you to roll back to the previous state with just a few clicks.
Wait just 30 seconds, and the domain routing switches back to the previous version. By setting up Zod validation, Gitleaks scanning, and Vercel rollback procedures, you can let non-developers build apps to their hearts' content while still sleeping soundly at night.