OVER DEZE AFLEVERING
What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them.
Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt.
The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.
Impactful Moments
00:00 - Introduction
02:15 - Busting the vibe coding myth
04:40 - Inside Orca's State of AI report
05:55 - The unpatched AI SDK problem
07:40 - What is AppGen?
10:20 - Who builds the backend?
12:25 - Inside Orca's AppGen hackathon
14:10 - Thinking like a citizen developer
15:15 - Who's really building these apps
19:25 - One misconfigured app, every integration exposed
20:45 - Why Supabase is the holy grail
23:00 - Checking your own exposure
24:30 - Why the SDLC is breaking down
26:55 - Prompting for a secure app
28:15 - Don't hand the agent every decision
31:20 - Staying sharp by never stopping learning
33:35 - From protecting environments to protecting apps
Links
Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/
Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/
Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part
Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party
–
Check out our upcoming events: https://www.hackervalley.com/livestreams
Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com
Become a sponsor of the show: https://hackervalley.com/work-with-us/
