How to Not Get Sued 101
Three vibecoded security mistakes that carry real fines (fake reviews, broken access checks, ignored accessibility), plus a free stock news bot that ranks headlines by price impact.
the short answer
Three vibecoded app mistakes carry real legal and financial risk: fake reviews (FTC fines up to $51,744 per review), missing ownership checks on predictable URLs (like the July 2026 Claude shared-chat indexing incident), and skipped accessibility work. Each has a one-line prompt fix, alongside a free open-source bot that ranks stock news by estimated price impact.
key takeaways
- The FTC can fine $51,744 per fake review, including AI-generated testimonials, so only display reviews traceable to a real person.
- Checking a user is logged in isn't enough; also verify they own the specific resource before returning it, or predictable URLs leak other people's data.
- Anthropic's July 2026 incident, where shared Claude chats got indexed by Google, is a real example of a missing noindex tag plus missing access checks.
- AI coding tools skip accessibility unless asked; missing alt text and bad contrast can trigger demand letters even without a lawsuit.
- A ~250-line Python bot can pull stock news via RSS, score it with an LLM that's allowed to say "I don't know," and rank headlines by estimated move times confidence.
Happy Monday, issue #1! Two parts each time: vibecoded app issues I see constantly plus how to fix them, and an agent I recently built that you're welcome to steal. If you're following the 30-Day App Roadmap, these are exactly the kind of gaps the week 4 security audit is meant to catch.
You guys loved my whiteboard video on vibecoded security, so here are 3 more that can get you a meeting with Harvey Specter if you ignore them.
1. Fake reviews got a price tag of $51,744. Per review.
Buying reviews, fake testimonials, your team dropping 5 stars on your own product, it used to just be a shady growth hack. Now the FTC's rule against fake reviews carries a civil penalty of $51,744 per violation, per review, not per company. It covers AI-generated testimonials too.
The fix. Tell your AI:
"Audit every review on the site. Flag any without a verifiable source, only display verified ones, and remove anything untraceable to a real person."
2. Anyone can view anyone else's data by changing a number in the URL
Your app checks someone's logged in, but never that they own the thing they're requesting. Change /orders/104 to /orders/105 and you've got someone else's data.
Anthropic ran into this in July: shared Claude chats had no "noindex" tag, so Google indexed thousands, medical records and API keys included.
Anthropic's own writeup on it, read the full story here:
thenextweb.com: Claude shared chats indexed by Google
It's cached elsewhere now too, and you could face HIPAA, GDPR, or CCPA rules.
The fix. Tell your AI:
"Audit every route reachable by a predictable URL. Add noindex and access checks where needed, and verify the requesting user actually owns the resource before returning private data."
3. Vibecoders hate disabled people.
AI tools don't think about accessibility unless you ask: missing alt text, no keyboard navigation, bad contrast. Law firms now scan for this automatically, and a broken alt-text setup can get you a demand letter for thousands, no warning.
The fix. Tell your AI:
"Add an accessibility statement targeting WCAG 2.1 AA, then audit for missing alt text, heading structure, and keyboard-navigable forms, and fix what you find."
This week's build: a stock news bot
This stock bot has genuinely been helpful for tracking a company I'm invested in. My morning news routine was getting out of hand, so I built a ~250-line Python bot that tracks one stock's news and sends the top 3 headlines to Telegram with direction, range, and confidence.
For example, this bot I made to track stock news and score price impact. You can use it for completely free here:
github.com/markpyvo/tradenewsbot
How it works. Three Google News RSS feeds pull the last day's articles, and duplicates get skipped by hashing each link.
Every surviving article gets sent to MiniMax M3, prompted to act like an analyst and answer in strict JSON with direction, estimated move, and confidence. If it's not confident, it returns null instead of guessing, since an LLM will invent a plausible number for a headline that says nothing unless you give it a way to say "I don't know."
Ranking isn't the LLM's job, it's just math: average estimated move times a confidence weight (high counts full, medium less, low least). A 3% move it's unsure about loses to a 2% move it's confident on.
Top 3 get sent to Telegram, the rest get dropped, that's what makes it usable. It runs twice daily via GitHub Actions since Vancouver's UTC offset shifts with daylight saving, so one run's a dud on purpose.
Best,
Mark Pyvovarov
frequently asked
How much can fake reviews actually cost a business?[+]
Under the FTC's rule against fake and AI-generated reviews, the civil penalty is $51,744 per violation, calculated per review, not per company.
What is the URL-based data leak vibecoders keep making?[+]
Apps often check that a user is logged in but never confirm they own the specific record they're requesting, so changing a number in the URL (like /orders/104 to /orders/105) exposes someone else's data.
What happened with Anthropic's shared Claude chats in July 2026?[+]
Shared Claude chats and artifacts had no noindex tag, so Google indexed thousands of them, some containing medical records and API keys, exposing a broader pattern of missing access and indexing controls.
What does the stock news bot actually do?[+]
It pulls a stock's news from three Google News RSS feeds, dedupes by hashing each link, sends surviving articles to an LLM for a direction/move/confidence score, ranks them by estimated move times confidence weight, and sends the top 3 to Telegram twice a day via GitHub Actions.
keep exploring