Ronnie, you've been vibe coding your production tools for a while now. Are you concerned about the security of these apps and services and how are they being audited?
ASKED BY · Alexander Knight · PORT COQUITLAM, BRITISH COLUMBIA · 24 OCT 2026 · ▶ 00:12:05
Recommended using BetterAuth service for multi-factor authentication options and paskey support stored in browser security key storage, which are more secure than traditional passwords.
Security best practices include IP whitelisting, rate limiting, using Cloudflare Access, and getting input from security experts; responsible disclosure of vulnerabilities is critical to prevent mass exploitation.
Security depends on deployment context: air-gapped internal tools have minimal risk, internet-exposed tools need careful authentication and penetration testing; using magic links instead of passwords and paskey authentication significantly improves security.
Summarised by AI from what the panel said. Watch the moment for the full answer.
From the transcript.
Machine-transcribed, so it may contain errors. Every timestamp opens the episode at that second.
11:31It's going to move smoothly into something like that. All right, let's move on to the next question. Next question comes from Alexander Knight in a place called Port Coquitlam, British Columbia. And who's today? Ronnie, you've been vibe coding your production tools for a while now. Are you concerned about the security of these apps and services and how are they being audited? You almost got Coquitlam.
12:05It's an M at the end, not an N, Courtney. Go ahead, Ronnie. Yes, of course. Of course, we've seen what can happen even last week. We've seen what can happen when big organizations are creating security holes in something that we expect to be solid software. I'm talking on the PHP. So most of the production tools we are using and developing is for internal use only.
12:34So they are sitting behind firewalls. And if someone comes through that firewall and starts playing with those tools, we have much bigger problems. So it's kind of seen as internal tools. And there is two camps here. One thinks that production tools should really be run in kind of air-gapped systems, which means that they are not connected to the Internet at all. all, so only be run internally and don't even have passwords to log into them.
13:12Whereas other tools are being deliberately made for being controlled through internet, for instance, or in larger installations where, for instance, bit focus buttons or bit focus companion are examples of those type of things. And they, of course, need to have some more security around them. Then you have, of course, direct tools that are planned and being run in the cloud. And in those cases, you really need to be thinking on security.
13:47And one thing we've stopped using as kind of a main rule, rule of thumb, is to never store username and password and instead have other means of logging into software. So instead of storing a password that can be hacked and used, we tend to go directly to either Magic Links, which then just send something to an email address and then creates a kind of two-way control instead of storing passwords.
14:18And then when you eventually are being logged in using, for instance, Magic Link, you can use passcode instead. So there are ways to kind of control the login part of that. And then you have, of course, the code penetration tests. I usually have some AI that actually do some penetration tests from the outside and try to hammer into the applications. And normally it's good and just feed that information back into the AI and then make it take care of that.
14:51But that also has something to do with the complexity of the application. So easy applications, easy to control, everything is good. And if it's internal, there's basically no problem. Makes sense. Courtney, what do you think? I was going to ask Karani, what do you do with these applications that have biometric passwords, where you had to use a fingerprint or a face unlock?
15:14How do you deal with applications like that? or what is the new service, the key, the new encryption replacing password key? What is it called? Key link? It's called PassKey. So let's say if we have a few applications where we are using this, we use, when we are vibe coding this, of course I do manual coding as well, but normally I use a service called BetterAuth, which is then making it
15:44it easier for me to apply different ways of authentication. For instance, Google login, like we have on the new website that you can find on devsite.officehours.global, a shameless plug for the new site. I'll leave a link in the chat as well. There we have different options to log in, for instance, using your Google account, which is then being just matched to your
Similar questions
from other episodes.
About the same products and topics, most related first.