Think Like a Hacker: Build Like a Bank. The complete security playbook, with 50 ready-to-use prompts, to lock down your vibe-coded app before hackers find it.
AI tools are brilliant at making an app that works. They don't automatically make one that is safe. You click around, everything works, you publish. Attackers see something very different. Flip the switch.
See why we wrote this book, what attackers do with apps that were built fast and never locked, and how to think like them so you can stay one step ahead.
Tobi had never worked at a software company. He had an idea, a laptop and an AI coding tool. By Sunday morning, SalonSlot was live in Lagos: customers could book appointments, pay deposits and upload a photo ID for verified bookings.
Every button worked. Tobi clicked around like every builder does, saw nothing break, and hit publish. Nothing told him that "working" and "safe" are two different things.
Forty salons signed up. Then three hundred. A popular creator posted about it. By week six, SalonSlot held 3,112 customers: names, phone numbers, home addresses, booking history and ID photos. On Friday, Tobi pitched an investor and felt, for the first time, like a real founder.
What he didn't know: when the AI built his database, it created the tables but never switched on the rules about who may read them. The app's public key sat in the page's code, where anyone could find it. Nobody was targeting Tobi. Automated tools scan for exactly this, all day, every day.
It took four minutes. No genius, no movie-style hacking. Just a stranger asking the database for everything, and the database saying yes.
We have your customers' names, numbers, addresses and ID photos. Send $12,000 in crypto within 48 hours or we publish everything, and we email every customer and the regulator ourselves. Do not test us.
Tobi read it four times. He didn't have $12,000. He didn't have a lawyer. He didn't know how many people he was supposed to tell. And he knew one more thing: the people who take that money don't sign contracts. Paying never guarantees anything.
Within hours, SalonSlot customers began receiving messages that knew their name, their salon and their appointment time. Real details make scams believable.
A lawyer's email arrived on behalf of affected customers. A regulator asked what happened, when Tobi found out, and why customers hadn't been told. Many data-protection laws expect a notice within about 72 hours. Tobi had never heard of the 72-hour rule.
His payment partner asked for an incident report. Three salons cancelled on the same day. The investor stopped replying.
Switch on the access rules. Move the key out of the browser. Lock the admin page. Put a limit on logins. Make the folder private. Not genius, just knowing what to ask the AI to do, and asking it precisely.
Keep scrolling to see the real companies that made versions of it, and what it cost them.
Get the playbookEvery case below was reported publicly. Look at how ordinary the mistake was in each one.
A dating-safety app kept verification selfies and ID photos in a cloud storage folder that was left open. About 72,000 images leaked, including roughly 13,000 selfies and ID photos. Ten potential class actions followed.
Source: NBC News ↗Its founder said he didn't write a single line of code. Researchers found a database key in the page's code and no access rules behind it: 1.5 million API tokens and 35,000 emails were exposed. Fixed within hours, but only after outsiders found it.
Source: TechRadar ↗Millions of customers' details were taken, reportedly through an API that required no login. The attacker demanded about A$1.5 million, then backed off, but the damage was done. Class actions and regulator action followed.
Source: Dark Reading ↗Attackers got in with stolen credentials on a portal that had no multi-factor login. UnitedHealth's CEO told Congress the company paid a $22 million ransom. About 100 million people were notified, and the cost ran into the billions.
Source: CNBC via NBC ↗The Nigeria Data Protection Commission fined MultiChoice Nigeria ₦766 million in 2025 and Fidelity Bank ₦555.8 million in 2024 for data-protection violations, and has opened more than a thousand investigations since the 2023 Act. Regulators are paying attention.
Source: Nairametrics ↗ Fidelity ↗Case summaries are condensed from public reporting. Follow the source links for full details. These companies are named as examples of publicly reported incidents; SteerDigitals is not affiliated with any of them.
Criminals set the price and the deadline. Optus faced a demand of about A$1.5 million. UnitedHealth paid $22 million, its CEO told Congress.
When customers' IDs and messages leak, they hire lawyers. Tea faced ten potential class actions.
Data-protection authorities investigate and fine. Nigeria's NDPC has fined companies hundreds of millions of naira.
Customers leave, partners pause, investors go quiet. IBM says lost business is one of the main drivers of rising breach costs.
AI builds what you ask for. If you never ask about security, you get an app that runs and a false sense of safety. And if you don't know what to look for, you can't tell what's missing.
That's the gap this book fills. It tells you what attackers look for, then gives your AI agent precise instructions to find it, fix it and test it.
To catch a thief, you have to think like one. Each practice in this book shows how an attacker sees that part of your app, explains it in plain words, then hands your AI agent exactly what to inspect, fix and test.
From secrets and logins to payments, databases and AI agents, in a sensible order.
Copy, paste, review. Built for the way you actually build.
Explained so a beginner understands, without losing the technical detail.
All 50 on one page. Tick them off before every release.
Mapped to the OWASP Top 10:2025 and current NIST password guidance.
Fake packages, prompt injection and coding-agent permissions are covered too.
App mapping, secrets, least privilege, accounts and pipelines.
5 practicesPasswords, MFA and passkeys, resets, sessions, tokens, social login.
8 practicesWho can do what, API doors, rate limits, payments and business rules.
8 practicesInput, injection, database rules, storage, encryption and uploads.
10 practicesHTTPS, security headers, CSRF, XSS and third-party scripts.
5 practicesDependencies, environments, servers, DDoS, email and errors.
6 practicesPackage traps, prompt injection and what your agent may do.
3 practicesScans, security tests, logging, backups and incident response.
5 practicesWhole tables being readable or editable by strangers, users seeing each other's data, and data theft through public keys.
A short lesson in plain words. A clear explanation of what it protects against. A few quick tips. Then a prompt that tells your AI agent exactly what to do, so you're never staring at a blank chat box wondering how to ask.
Get all 50 practicesYou built it with prompts and it works. Now make sure it's safe before real customers trust it.
Deliver client apps you're proud to put your name on, and a checklist that proves you did the work.
Move fast without letting your agent leak keys, install fake packages or skip the boring-but-vital checks.
No security background needed. Every idea is explained in plain language, step by step.
A shared playbook your whole team can follow from day one.
If you store names, phone numbers, IDs or payments, you're already a target.
Yes. Everything is explained in simple language, and each practice gives you a prompt to paste into your AI coding tool. You review the result, so you stay in control without needing a security background.
Any of them. The prompts are written to work with tools like Claude Code, Codex, Cursor, Lovable, Replit and Bolt. Tell your agent which stack you use and it adapts.
No guide can honestly promise that. This one closes the most common and most costly holes, the ones behind real breaches. If your app handles money, health data or large amounts of personal information, have a security professional review it as well.
Yes. It includes practices for fake packages suggested by AI, prompt injection in AI features, and controlling what your coding agent is allowed to see and do.
It's a digital PDF of 42 pages. You buy it through Selar, and the link on this page takes you straight to checkout.
No. It's a practical playbook you use while you build: read a practice, apply the prompt, check the result, tick it off the checklist.
Get the playbook, work through the checklist, and launch knowing you built it like a bank.
Get Think Like a Hacker now
