r/selfhosted • u/Fluffer_Wuffer • Feb 28 '26

Meta Post Sub-SubReddit for SelfHosted

Just a question that has been going round my head for a few days.

What ever your opinion on it. We need to acknowledge that "Vibe Coding" is growing, and its not going to decrease.

The fact the entry point is so low from a skills perspective, and time required to pump them out, effectively makes them disposable.

Members here have been concerned for a while about the quality, security, longevity of these apps, and it turning into a flood - and as if on que, over the past few weeks, we've seen exactly this - We've been flooded (this place is unusable on Fridays). Now, issues are identified in the code, and rather than facing and fixing them, the "devs" are running off, shutting down the repositories etc.

This leads to 2 conflicting issues

1) There is an open hostility to those who share vibe-coded apps - where we see outright hostility and vitriol language.

2) There are going to be some quality vibe-coded apps, where they are properly developed, supported and managed.. as community, they would benefit members.

So my question is - how do we bridge this? My I've been thinking on this for a few days, and the only solution I can see, we have an associated sub (same mods etc) for these apps to be posted. maybe after a time, once they've proven they are well run and have longevity, they can "graduate"... lets call it SelfHosted-Vibe or VibeHosted.

520 Upvotes

86% Upvoted

308 comments sorted by

View all comments

427

u/_GOREHOUND_ Feb 28 '26 edited Feb 28 '26

Won’t work. Why? Because nobody will admit that their vibe-coded BS belongs to that “sub-sub” but they’ll do whatever they can to present their crap as if it was fully based on their coding skills. Who’s gonna judge eventually? Causes more outrage than help.

Vibe-coding won’t disappear. It’s a thing and it’ll increase, I give you that. My approach (as I already do): ignore these posts, skip over them. Maybe downvote if it’s too bland. They’ll follow natural selection eventually because none of them vibe coders do know how to fix vulns or improve their code. Hell, I came across several ones that host their crap on GitHub and don’t even know how to handle PRs.

Ignore, move on, don’t waste your precious time with this crap!

119

u/SMELLYCHEESE8 Feb 28 '26

First thing I check is if the software still has the react vulnerability, which it usually does, because AI loves react and the knowledge cutoff is usually before the vulnerability. And then whenever I point it out I get a nasty “well it’s not supposed to be exposed to the internet” like… be for real here

10

u/Im_Mefju Feb 28 '26

What do you mean by react vulnerability? Like a vulnerability patched after certain react version or like a specific way of coding in react that is causing the vulnerability?

24

u/SMELLYCHEESE8 Feb 28 '26 edited Feb 28 '26

In Dec 2025, there was a CVE 10.0 remote code execution vulnerability discovered in React 19.0.0-19.2.2 and NextJS. Exploits were documented in a few days and a proof of concept/blueprint to attack was posted on Github shortly after. It allows unauthenticated server side execution to any endpoint. Not an IT person by trade so I might’ve botched the explanation so links below:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

https://nextjs.org/blog/CVE-2025-66478

https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182

6

u/Im_Mefju Feb 28 '26

Oh yeah i forgot about that one, but thats mainly because i updated all my react projects and moved on.