--- title: 'Mayumi Case: Did Vibe Coding Go Wrong?' source: 'https://youtube.com/watch?v=F9mP_QMRZgg' video_id: 'F9mP_QMRZgg' date: 2026-07-27 duration_sec: 784 --- # Mayumi Case: Did Vibe Coding Go Wrong? > Source: [Mayumi Case: Did Vibe Coding Go Wrong?](https://youtube.com/watch?v=F9mP_QMRZgg) ## Summary This video analyzes the Mayumi case, where a platform built using Vibe Coding (AI-assisted development) suffered a massive data leak due to basic security flaws. It explores the risks of relying on AI without proper security review and provides essential security principles for developers. ### Key Points - **Introduction to the Mayumi incident** [00:01] — A streamer named Mayumi launched a platform called Kipí that criticized competitors' backends but ended up leaking customer data due to lack of basic security. - **Definition of Vibe Coding** [00:28] — Vibe Coding is using AI to generate code quickly, allowing non-programmers to create apps by describing ideas in natural language. - **Mayumi's approach** [01:46] — She mocked competitors like OnlyFans and Privacy for their backends, claiming her team had superior talent, but the result was a security disaster. - **Basic security flaws discovered** [03:03] — The platform had no authentication or authorization; anyone could access names, emails, phone numbers, and addresses directly via the API. - **How Vibe Code was used** [04:10] — The project was built entirely with AI-generated code, without any technical review, leading to missing locks on data routes. - **Three security principles** [05:25] — Authentication (login), authorization (permissions), and access control (blocking unauthorized access) are fundamental and were all absent. - **API without locks** [06:08] — The API worked as a help desk but had no verification or blocking, allowing anyone to request sensitive data. - **Contradiction in claims** [07:44] — Mayumi bragged about her team but delivered the opposite; the platform had to be taken offline, refunds issued, and accounts deleted. - **Testing advice** [08:09] — Don't just check if the site works—test by trying to access without login, pull data from API, tamper with IDs, force errors. - **Security is architectural** [09:25] — Security must be thought from the start—what runs on client vs server, what can be exposed, and tokens must never leave the backend. - **Cybersecurity awareness** [12:10] — With AI, more people will understand basics, but for now, never trust 100% and treat data as serious business. ### Conclusion Vibe Coding can accelerate development but must be paired with rigorous security testing and human oversight to avoid catastrophic data breaches. ## Transcript publicly criticizing competitors' technology, promising a much entire internet starts pointing out basic because a hacker leaked all your customers' data. Well, something Miumi's platform, which aimed to be an alternative to Privacy and onlys. This is the perfect opportunity for us to Vibe Code. I want to answer that question. Is it possible to have security question. Is it possible to have security using Vibe Code? opportunities, about using artificial intelligence in your work, about salary. But some people go a little too far. And I decided to use to give you a very interesting perspective on Vib, which is the use of artificial intelligence to create websites and platforms, right? You're using AI (Artificial Intelligence) to generate the entire program for you, right? We use this ourselves on our side, okay? I even think that with Vibe Code, own website, everyone will be able to say, everyone can code now, everyone can program. And this video is not an advertisement for any Vibode platform, OK? But it's a reality. What I'm trying to say is that soon, vibe coding will be a common part of everyday life. Everyone will have a Jarvis to code for you, you understand? Jarves, make me an app, a little game where the bird Yes, you will create your own flapd, you can create it now. All you need is an idea and then you just future irritates many programmers, and people get very Miomi, for example. So, let's give you some context about the story. Miami, who I think is a League of Legends streamer, decided to launch a platform with exclusive content called Kipí. That's fine, anyone can do strategies for launching her idea was to directly confront and criticize the backend, that is, the hidden part of rival platforms. What were the rival platforms? Privacy and [music] only fancy. But what is that? P back end, dude. front end. What do you see here now ? YouTube, do you agree? But you 're only seeing the front part of YouTube. But what about YouTube's programming? Are n't you coming? So it's the back end that handles all the programming logic, the you can't see in this image. Damn, she, damn, she crushed and Privacy, which also sell exclusive content. The idea of ​​the Miami platform is actually a very good idea, isn't it? She envisioned creating a platform more focused on community and less on adult content. And I think there's room for that. I think if you look at the market, there are many possibilities. There are people think are already dominated, but you can bring a different approach and create something that goes viral or is of public utility. And this whole back-end thing isn't jab at the competition, man. It's do that. When you have a competitor, you can certainly exploit that competitor's weaknesses and position your product as a solution to that problem. The problem is that even Mayomi's didn't work. Besides criticizing it, talented engineers working on her app with her, right? No, I have the best team in the world here, right? But the result was simply a disaster, and the community went on the offensive, man, without sleep, massacring them. Damn, dude, seriously, it they discovered that the site had flaws, basic security issues, nothing complex. Basic. And when I say basic, I mean really basic. Anyone could access sensitive data, such as names, emails, phone numbers, authentication. Dude, imagine getting in there and simply having access to everyone registered there. Man, that's really bad , isn't it? You guys are aware of the problems this causes nowadays, with various measures from the LGPD, which is the General Data Protection Law. This can for anyone who doesn't handle third-party data securely. And because of how easily childish mistakes like that one leak, the project is completely built using Vibe Code, meaning the giant is being used to generate code quickly and without any technical review. In other words, there is no team at all. It was made by AI. You can't tell when you have, for becomes very clear. I know that sometimes it's not noticeable, but sometimes it becomes so clear that you realize it. Programming is the same thing, man. Same thing. Okay, don't know what Vibe Code is at the time of this video, I'm going to explain. Vibe Code is about creating software and applications with the help of A. Instead of spending bring your idea to life much faster this way. You don't need to hire teams to program for you. It's literally programming, just in a different way, right? That's because the programmer or programmers or team of programmers focus more on the idea and the vibe of the project, using artificial intelligence tools to write almost all the code. You can write all the code, you understand? Sure, sure, right? You can do it. But I wouldn't reviewed by a programmer. Like, you have an idea, website, for a site. Then you put that idea into an agent, an AI, a program, precisely so that this AI can execute your idea for you. to generate the assume that, in the case of Kip's platform that Miami devised, Vibe Code was indeed used. Let's assume she actually used Vibe Code, this is a hypothetical, fictional scenario, OK? I'm imagining doing this exercise with you guys. AI excels at creating beautiful interfaces and visually appealing functions, but it can security protocols. In Kipo's case, she may have created the data routes, but forgot to put the locks on all that data. Anyone could programmer here, OK? Because I am primarily a programmer, that's how I started my career. In other words, the problem fails in three basic security principles that could have been avoided: authentication, authorization, and access control. Authentication is the login process; it's where you prove that you are who you say you are. The question is about authorization; can you see that? In other words, the system checks if access that resource, if they paid to access it. And access control is the prevents anyone from getting where they shouldn't get. And what seems to have system had the data. The API worked, but it didn't have any locks. don't know what an API is, this might be confusing for you. The API is like a system help desk, but only for programmers, where the app requests data and example, that I want to, I want to make a website, OK? In order for me to access data from YouTube, I need to ask YouTube's code communicating with my website's code. Here, take this. You can access this data here, right? Views, likes, dislikes, IP providing everything to us, systems and software are able to communicate. Like, if I have a food blog and a Google map within my food blog to help you find restaurants, how am I getting that map? I'm able to do it through the Google Maps API. I accessed the Google Maps API and I'm positioning myself within it. I used the map API in there. Uber does that, right? Use some GPS API from some other provider to be able to integrate it into Uber. But in practice, man, it was that simple. He asked, he received, no login, no verification, no blocking. And sensitive data, right? We're talking about name, email, phone number, address, serious. This type of data cannot be exposed under any circumstances. It needs protection because, well, it involves privacy, money, it involves money , even legal issues. This is far too problematic. In short, the system worked, but lacked basic security. This isn't advanced technology; it's the bare minimum any system should have. And another thing, she basically said that the competitors didn't have a good back end, that she had a talented group of money and managed to do everything the opposite way. They didn't have it, I did, but it didn't attention to this whole thing about using artificial intelligence. Guys, why am I saying talking to you guys about this, right? If you want to use AI for development, great, go ahead. I use it too, but you have to do it the right way. First, don't publish anything without testing its security. [music] That's kind of obvious, right? But it careful with that. It can give you a giant dick. When I say test, I don't just mean opening the website and seeing if it works, damn it. It is not. It's about real testing, trying to access without logging in, trying to pull data directly from the API, messing with IDs, forcing errors. Trying to force an error, man. Trying to find a bug. If you don't do it, someone else will do it for you. And that's where your data and your if you're involving other people's data and real money, the least you can do is hire someone to test it. Hey, honey, you're someone, it's the least investment you can make, man. There are freelancers competitive prices, you won't spend that much, and you'll avoid a huge headache. Secondly, he doesn't trust AI 100%. Never, never, for now, never, right? I know about the future. It accelerates a lot there. True. Fact. But she's not thinking about your safety. If you don't have someone reviewing it, you could unknowingly put sensitive data at risk and turn the memory into a huge problem. Like, in Mayumi's case nothing major happened, but the platform's launch had to be postponed and taken offline immediately. Immediately, everyone who had created an account had their account deleted, and those who had paid received a refund. All this in an attempt to contain the damage and avoid receiving a barrage of fines and even lawsuits. Do you guys have any idea what a headache this caused for her and message from this video, it's this: security is an architectural problem. Aá is an engineer who puts together a nice, quick setup, but the architect is the one who architect or hire someone to be security. It's not just a matter of putting a login on the screen, man, and thinking that solves the problem. Everything I've said so far is important, man. It's part of everything. So, the system architecture needs to be well thought out from the very beginning of any project you undertake, because you need to decide very carefully what runs on the client, what runs on the server, what can be exposed, and what can never leave the back end, such as user tokens, without don't want just anyone to have access to this, do you agree? And that's Miami project failed. And as I've been telling you guys, it's precisely in fail. Dude, have you ever thought about me launching an app for you guys? You paid you [ __ ] believe in the product, right? And I'm simply going to expose it by showing that all the data was right there in front of anyone who wanted to know; you trusted me to keep safe. Now, if there's one thing I've released that asked me today, Peter, what's the best investment you've ever made for your setup? Without hesitation, I can say that it was, look, this chair here, the Caleina from Elements. And I'll explain why, in recent years, I've been using a regular only make those stops. The problem is that this type of chair wasn't made for people who are focused on their work, it's not designed for people who spend their days developing, designing projects, programming, and over time this will even demotivate you without I'm wearing this one from Elements, right? That I need to perform well every day. That's why nice office, a home office chair that I can use to record my videos every day. And the cool thing is this , look. This chair even looks like it's meant for man, sometimes the music even shakes, man. It's too delicious. Sometimes he pauses here, relaxes, trembles here, and gets a massage in his lower back. If I I've left the link below for you to buy your chair. There are several models You, the business owner watching this, invest in an Anim QR Recode chair; it's scan. Oh, and there's a coupon, an Iné coupon to get even more discounts. Enjoy it while you can. Miami thing seems simple, but even experienced developers can get confused. So you really have to pay attention, there's no way around it. The front end, which is nothing more than the visual part of the website or app, right? safety. You have to ensure security to validate access, right? too much data, thinking the user won't see it. The front line is based on experience, blocks a screen there, organizes the navigation, but he can't have the final say. The real security barrier needs to be on the back end. isn't just about making the code run. The entire structure needs to have a solid function, right? When the foundation is flawed from the start, artificial intelligence cannot fix the the error faster. And that. And another thing, guys, cybersecurity is a become more familiar with these things. Now with AI, making spend years studying, the trend is that more people will understand the basics of security so that these basic errors stop happening. And if happen anymore, they won't be common anymore, right? So, for now, don't rely 100% on AI, focus on the project as a whole, and always remember that when we're dealing with data, we're dealing with serious business. So, take it seriously too. complete, it's worth investing in a chair that will help you discover your Elis chair, and the QR code is on the screen. Use the Thank you for this video. I hope you enjoyed it. Comment the Miami platform, tell the truth, man. I'm watching you, okay? Thanks, man. I'm watching you, okay? Thanks, everyone. Until next time.