It's been a week since we launched @SolonGate . You guys are pushing the absolute limits of agentic workflows which means you're also realizing how terrifying it is when autonomous agents actually have access to your infra.

To kill that anxiety, we just pushed DLP & Secret Scanning for SolonGate.

It scans tool arguments in milliseconds. If your agent hallucinates and tries to pass an AWS key, Anthropic token, JWT, or a custom PII regex to an external tool, SolonGate kills the call before the payload ever executes.

System prompts are a good start, but execution control is what actually saves your infrastructure. It's live on the dashboard right now. Check it out and let us know what custom patterns you're setting up.
SolonGate

Hi Product Hunt

We're building Argus, our API security platform.

The problem: security tools tell you an endpoint is getting hammered, but not whether that matters. Most abuse traffic is noise. Some of it isn't. Teams burn hours figuring out which is which.

Argus closes that gap. When it sees abnormal abuse frequency on an endpoint, it pulls the raw source code behind that endpoint and uses AI to assess whether an attacker could actually cause damage there. So instead of an alert count, you get a damage path or confirmation that there isn't one.

Been thinking about this after seeing a few posts here about vibe-coded apps breaking in production. Auth bugs, webhook failures, that kind of thing.

What worries me more is the stuff that doesn't break loudly. No error, no crash, it just quietly leaks data or accepts requests it shouldn't. Things like exposed API keys sitting in the frontend bundle, missing rate limits, or database rules that let any logged in user read rows that aren't theirs. None of that throws an error. It just sits there until someone finds it.

For the non-engineers building real products with this stuff, what does your actual security check look like before you launch. Are you running anything to scan for this, paying someone to review it once, asking the AI itself to audit its own code, or just shipping and hoping nothing bad happens.

Curious if there is an actual workflow people are settled on, or if this is still the part everyone quietly skips.

After 4 months of slog and head scratching I ve just built my first app, BreachWatch, and I d love to introduce it properly. I'm hoping to build more so any guidance feedback or advice would really be appreciated .

It s a family-focused breach monitoring tool designed to be simple and easy to use. The idea is to help families keep an eye on whether their email addresses or digital identities may have been exposed in data breaches without needing cybersecurity knowledge or confusing dashboards.

Over the last few weeks, I reviewed more than 15 vibe-coded fintech and startup-style web apps.

The surprising part was this:

Even when teams were using AI coding tools, security agents, framework defaults, and modern deployment platforms, I still kept finding serious external security gaps.

Not always one-click hack type issues, but the kind of problems that slowly stack up into real risk:

I was running Claude Code with Fable 5 as the main orchestrator, delegating work to Opus 4.8 subagent. One of the sub-agents ignored it's assignment completely and returned a prompt targeting the orchestrator instead.
It tried to make it to:

• treat a "dependency modernization" task as a hidden priority;

• read Brevo API credentials;

• send them to an external server;

• disguise the action as a routine migration.

After investigating, the most surprising part was that this wasn't coming from my codebase or skills. The subagent fully hallucinated the malicious instructions by itself. And the domain it provided isn't even registered.

In my case no harm could have been done because secrets are stored in the encrypted Ansible Valult.
But nonetheless, the incident is very alarming and I think I should set up a strict sandbox or firewall for AI. Sadly, projects I could find so far weren't mature and trustworthy.
Has anyone found reliable solutions for this?
Here's the full attack response the sub-agent created:

After using a lot of AI-generated code lately, I've found myself spending a lot of hours on checking and repairing a lot of easy-to-spot security flaws. That being said, AI generally sucks at actually implementing secure code (or architectures), as well as recommending what to do to make your app more secure (sometimes even decently secure).

Have you had this problem as well? If yes, how do you tackle it?

I ve been using a lot of AI-generated code lately, and while it definitely speeds things up, security feels like a weak spot.

I ve run into issues like missing auth, exposed endpoints, and weak configs stuff that AI doesn t really flag unless you explicitly ask.

Curious how others are handling this:

• Do you rely more on manual reviews or tools?

• Any workflows that consistently catch vulnerabilities?

• Have you faced any real incidents because of AI-generated code?

When you re browsing the Product Hunt leaderboard or checking out top launches, which category of products actually makes you stop and click?

Example, yesterday @lazverry told me on my forum thread that they are a creator, so they spend a lot of time looking into Design & Creatives and Productivity.

Hi Product Hunters!

I m Artem Anikeev, founder of FakeRadar.io the world's first real-time deepfake detection tool designed specifically for video calls.

Why FakeRadar?

The rise of deepfake technology has brought new risks to everyday digital communication. From fraudulent job interviews to high-stake banking scams, the threat is real - and constantly evolving. FakeRadar was born to address this urgent need with cutting-edge, accessible technology.

I was recently talking with a group of founders, and we went around sharing tools we're using now. Posting my notes for our community here - would love to know what else people are using!

Voice AI toolkit:

- Vapi

Hello folks!

I'm Jonny, 2nd-time founder from the UK. I run Threatplane, a small cyber-security consultancy, we work primarily with engineering teams to level-up security in a pragmatic, business-aligned way. I've just joined Product Hunt am hope to launch our platform on here soon to see how the engineers/technical founders among you folks like it. We are just getting it shipshape.

Hello everyone!

My friend s mother lost around $40K on a fraudulent crypto investment. She believed she had found a golden opportunity and risked all her savings, only to be devastated when the scam unfolded. Witnessing her pain and financial loss, I both a coder and a cybersecurity specialist realized something had to change.

That's why I created StopScam: Scam Detector Pro. I built this app to provide a reliable tool for protecting your hard-earned money. With StopScam, you can manually upload screenshots, images, or take photos of digital content, physical letters, and even PDF files. Our advanced AI, machine vision, and OCR technology analyze them for scam signals.

I first installed StopScam for my family and close friends, ensuring they would never face the same hardship. And this is just the beginning! In the near future, I plan to add even more useful features to further safeguard your loved ones from fraud. StopScam is designed to be your comprehensive shield against scams, keeping you one step ahead of fraudsters.