Securing the Apps Everyone Is Building with Roi Nisimi and Yonatan Levi

What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them.Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt.The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.

Impactful Moments

00:00 - Introduction02:15 - Busting the vibe coding myth04:40 - Inside Orca's State of AI report05:55 - The unpatched AI SDK problem07:40 - What is AppGen?10:20 - Who builds the backend?12:25 - Inside Orca's AppGen hackathon14:10 - Thinking like a citizen developer15:15 - Who's really building these apps19:25 - One misconfigured app, every integration exposed20:45 - Why Supabase is the holy grail23:00 - Checking your own exposure24:30 - Why the SDLC is breaking down26:55 - Prompting for a secure app28:15 - Don't hand the agent every decision31:20 - Staying sharp by never stopping learning33:35 - From protecting environments to protecting apps

Links

Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/

Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/

Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part

Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/