Zachi(@iam_zachi):Quick test for your app: what happens if a free user calls your premium endpoint directly? If you’re not sure, it probably works. I keep finding this in vibecoded apps. The reasoning is always the same: “free users can’t reach that button in the UI, so anyone hitting the endpoint must have paid.” But your app sends every request in plain sight. Open a proxy, read the traffic, replay the call. No hacking required, your premium tier is just… there. The UI isn’t your paywall. Your backend is. Verify the subscription server-side, on every paid request.

Zachi

@iam_zachi

I develop and do some security stuff 38x CVE‘s 🙋🏽‍♂️ 📱 🐘 🧩

参加 December 2024

267 フォロー中 4.9K ファン

Zachi@iam_zachi

2026.09.02 12:12

Quick test for your app: what happens if a free user calls your premium endpoint directly? If you’re not sure, it probably works. I keep finding this in vibecoded apps. The reasoning is always the same: “free users can’t reach that button in the UI, so anyone hitting the endpoint must have paid.” But your app sends every request in plain sight. Open a proxy, read the traffic, replay the call. No hacking required, your premium tier is just… there. The UI isn’t your paywall. Your backend is. Verify the subscription server-side, on every paid request.