I don't see any indication in the post that these cases involved someone writing their own authentication code. This is about authorization mistakes, or the lack of any authorization. And that part you have to write yourself in some way (even if you use libraries), someone has to define the rules about which data is accessible under which rules. Using a pre-made library won't save you from defining those rules wrong.

To me only hard rule like this is to never implement your own cryptographic code. A decent developer can easily implement simple session-based authentication safely, or at least I'd suspect the chance of mistakes is no higher than this developer misconfiguring a much more complex library for authentication.

I've started putting OIDC auth in front of my app (at the gateway level) so that no matter how badly my LLM botches the app, requests can't get through.

This only really works with 1-person apps though. If you need multiple users then you have to match the login with specific database records to make sure you're only exposing the right stuff.

I guess that is to say, even if your authentication is great, you can still botch the authorization.

In the article:

>In its marketing, Lovable repeatedly emphasizes that no technical knowledge is needed to build projects. This can give the impression that the platform takes care of security too. Yet Lovable’s Terms & Conditions place responsibility for applications and data handling on the customers themselves.

My point is that the way Lovable websites are generated pretty much made no auth or mistake prone from scratch auth stack the default path with no regard to the security problem down the line, and the people they are marketing to are not decent developers or developers at all really, but people who doesn't have much knowledge about software, which is irresponsible.

Where is that rule written? You can build a really solid auth system, if you follow the rules. Also, what kind of auth method are you mentioning?

The thing is that in auth (like in cryptography) the rulebook is 2000 pages and there is an annotation book of another 2000. If you miss one page, the llm doesn't and will open you like a tuna can.

What 2000 page auth(n) are you referring to?

[delayed]

No? The rule is don't roll your own crypto. Building your own auth is normal and learning to do so ought to be expected as part of the standard education of a backend developer. I suppose next I might hear something like never define your own table schemas...