RS357: I Got Hacked

This week on the Rogue Startups, Craig gets roasted. He brought in experienced software engineer Brandon Hancock after building the AI-powered SaaS app Outlier largely through “vibe coding,” so Brandon could audit the entire codebase live during the episode. The result? An honest but useful breakdown of what happens when non-technical founders ship fast with AI tools.

Brandon digs into real security risks, common architecture mistakes, and the best practices every founder should follow when building AI-driven products. If you’re launching SaaS with tools like Next.js, Supabase, and Claude, or simply adding AI features to your existing product, this episode offers practical lessons on building faster without accidentally breaking everything.

Check the episode out on YouTube to see Brandon dig through Craig’s code onscreen.

Highlights from Craig and Brandon’s conversation:

What “vibe coding” looks like when building a real production startup

How a single exposed Supabase key can create major security risks

Why row-level security is critical for protecting user data

Using AI to audit code and uncover vulnerabilities in minutes

Simple fixes that dramatically improve SaaS security

Why many AI code review tools miss critical issues

The danger of exposing backend clients in frontend code

How server actions can replace many API endpoints