Do you think if the agency hired a consultant to build this , a consultant couldn’t have made the same mistakes?
Lack of security theater is a good thing for most businesses
Lack of security theater is a good thing for most businesses
I’m not even sure what your last comment means, are you contending that it is a good thing this company violated multiple laws with sensitive patient data?
AI does the same thing an agency or dev would do. Those vibe coding platforms have a template for these things which is usually Vite + React with Supabase for the backend, the same as a dev might use because surprise the LLM trained on the dev's work.
OP's point is that you're not guaranteed a good outcome hiring an agency or solo dev either, in fact I would say you're almost guaranteed a bad outcome either way.
> All "access control" logic lived in the JavaScript on the client side, meaning the data was literally one curl command away from anyone who looked.
They are not the same thing.
In this case the "client" is fully liable for the security issues.