The Latest

We may earn a commission from links on this page.

Under James Gunn's tenure, the DC Universe has promised us variety, and in that spirit, we're soon getting Lanterns, a show that stars Kyle Chandler as veteran Green Lantern Hal Jordan and Aaron Pierre as new recruit John Stewart fighting evil...in Nebraska. The two superheroes find themselves investigating a murder in a tiny town, a far cry from the typical intergalactic adventures of the Green Lantern Corps, space cops who can create just about anything with their fancy-schmancy rings. (Though it's not without precedent, as the 1970s comics saw Hal team up with Green Arrow to travel the country and see how we live here on the ground.)

It's obviously early days for the new HBO Max series, and it is as yet unclear whether it will be viewed as a clever genre twist or a too-constrained waste of potential. Either way, Lanterns won't be the first show to push the boundaries of the sci-fi and superhero genres. Here are 10 others that have arguably pulled it off.

Watchmen (2019)

A standalone sequel to the groundbreaking Alan Moore, Dave Gibbons, and John Higgins graphic novel from the '80s, this series plays in the sandbox of that book (arguably the wellspring of all modern superhero deconstruction), with a little help from Lanterns co-creator Damon Lindelof. In an alternate Tulsa, Oklahoma, in a world where super-powered vigilantes exist and have been outlawed, the series starts with a depiction of the real-life massacre and destruction of Tulsa's Black Wall Street by white residents in 1921. Regina King plays Angela Abar, a modern cop whose grandparents were killed during those attacks, events that echo throughout the series, which focuses on the fallout from the plot of the original comic and the conspiracies that grew out of it. Like Lanterns, this show's focus is on life on the ground in a world where gods fly above. Stream Watchmen on HBO Max or buy episodes from Prime Video.

Green Lantern: The Animated Series (2011 – 2013)

Almost certainly the best adaptation of Green Lantern to date, this show, from some of the people behind Batman: The Animated Series, doesn't take a grounded approach in the least, instead going in quite the opposite direction. Instead, it mines decades of comics' lore to send GL and company into deep space for some of the biggest adventures imaginable. Hal Jordan (Josh Keaton) is one of the finest Lanterns in the Corps, but his reputation for recklessness has led his superiors to distrust him. When he learns that rage-fueled Red Lanterns are murdering his compatriots in deep space, he defies orders and steals a prototype ship to help. Things get complicated on the frontier, as the show balances individual adventures with a longer storyline about the nature of the Red Lanterns, and whether their green counterparts are entirely the good guys. Buy Green Lantern: The Animated Series from Prime Video.

The Penguin (2024)

There's nothing new about going grim-and-gritty with stories set in Gotham City, so this is perhaps slightly less of a departure than Lanterns—still, a prestige crime drama in a superhero world was new-ish territory way back in 2024. A spin-off of the latest Batman movie (the Robert Pattinson one), the show stars Colin Farrell as the up-and-coming mobster of the title. In the wake of the killing of boss Carmine Falcone. the Penguin and the absolutely unhinged Sofia Falcone (Cristin Milioti, who won an Emmy for the role) are vying for control of the underworld. After decades of live-action Batman tales, it's kind of refreshing to see what's going on in Gotham City when the Caped Crusader has his back turned. Stream The Penguin on HBO Max.

Superman & Lois (2021 – 2024)

It's saying quite a bit to suggest that Elizabeth Tulloch and Tyler Hoechlin are among the finest live-action Lois and Clark pairings ever, but here we are. Skipping over the will-they/won't-they of earlier takes, the show jumps ahead to find the two married and with two teenage children, Jonathan and Jordan. The couple has just moved back to Smallville to give the kids a semblance of a normal life. Good luck with that! The show balances small-town drama with big superhero stakes, never more so than in the later seasons, when community-minded crime boss Bruno Mannheim (Chad L. Coleman) uses a Bizarro-style clone to put Superman out of his way while their wives both battle cancer. Stream Superman & Lois on HBO Max.

Doom Patrol (2019 – 2023)

Here's an uncharacteristically bold and indescribably freaky entry in the superhero canon, including characters like the non-binary Danny the Street (a literal street), paranormal investigators the Sex Men, Imaginary Jesus, and orgasm-generating bodybuilder Flex Mentallo. All the weirdness is grounded in excellent, frequently emotional character work from the entire cast, including Brendan Fraser, Matt Bomer, April Bowlby, Diane Guerrero, Joivan Wade, Michelle Gomez, and Timothy Dalton. It’s queer and sex-positive, making it a standout among the usually chaste, straight world of superheroes on TV. Stream Doom Patrol on HBO Max.

Batman: Caped Crusader (2024 – )

There's a lot of Batman out there, but this one's got real style, harkening back to Batman: The Animated Series from the 1990s (no surprise, given that Bruce Timm developed this one too). With a 1940s-esque setting, the show dodges some of the more outlandish superhero tropes to focus on a Gotham City rife with crime, corrupt cops, and gang warfare. It doesn't reinvent the wheel, exactly, but it's a strong enough reimagining that it feels fresh, particularly given that every other superhero show seems to require a deep investment in crossovers and spin-offs. Stream Batman: Caped Crusader Prime Video.

Creature Commandos (2024 – )

This animated show sees Amanda Waller (Viola Davis, reprising the role from the live-action DC movies) assembling a black-ops team to protect a foreign nation from the Amazonian sorceress Circe. Waller can't be trusted with actual humans, so her team is made up entirely of literal monsters: The Bride (Indira Varma), Doctor Phosphorus (Alan Tudyk), Eric Frankenstein (David Harbour), and aquatic mutant Nina Mazursky (Zoë Chao), alongside Nazi-obsessed G.I. Robot and the rodent-like Weasel (both Sean Gunn). Extremely violent and with a dark sense of humor, this show from James Gunn and company also brings an impressive amount of heart to the mix. Plus, it's set in the same relatively young universe as Lanterns, so you won't be behind on your homework. Stream Creature Commandos on HBO Max.

Echo (2024)

Alaqua Cox returns to her Hawkeye role of Maya Lopez, a deaf assassin who once worked for Vincent D'Onofrio's Wilson Fisk. She's now on the run from the mob boss, returning to her hometown in Oklahoma to come to terms with her past and to reconnect with her family and roots in the Choctaw Nation. The personal stakes mark a welcome shift toward the personal and away from the multiversal scale of the most recent Marvel—even as the show's scope encompasses centuries of Choctaw history. Stream Echo on Disney+.

Andor (2022 – 2025)

They might be galaxies apart, but if you're looking for a grounded show born from a sci-fi premise, look no further than Andor. Just when I felt like I was done with Star Wars, along came this prequel series, the morally complex story of thief-turned-rebel spy Cassian Andor (Diego Luna) being radicalized and setting out on the road to becoming the heart and soul of the Rebellion. We witness the slow march of the Empire, as citizens of the galaxy become acclimated to rising fascism, and delve into the conflicts between various rebel factions: Genevieve O'Reilly's Mon Mothma fights from within the Galactic Senate, while Stellan Skarsgård's Luthen Rael, Andor's handler, favors dark deeds done under cover of darkness. Forest Whitaker's Saw Gerrera is content to burn the Galaxy down rather than allow it to become what he hates. The scope is grand, but the focus is very much on the people at the bottom of the ladder, and what they do or don't do in the face of tyranny. There's also a lot of dust. Stream Andor on Disney+.

True Detective (2014 – )

There's been a lot of talk about Lanterns being the DC universe's explicit answer to True Detective, so here we are. This crime anthology started out by taking us to Oklahoma, with Matthew McConaughey and Woody Harrelson investigating a murder that led to a broader mystery that bordered on the cosmic. The most recent season similarly sees veteran Chief Liz Danvers (Jodie Foster) and Trooper Evangeline Navarro (Kali Reis) face their complicated pasts while searching for missing scientists at a research station in a remote Alaskan town. Stream True Detective on HBO Max.


from Lifehacker https://ift.tt/749FpNL

Over the past seven years, Apple TV has slowly become the streaming service to beat. The platform now has a plethora of must-see TV programs, from buzzy hits like Ted Lasso, Severance, and Shrinking to strong sci-fi fare like Foundation and Silo—not to mention Apple Original movies, including Killers of the Flower Moon, F1, and Coda. While the streaming service isn't the first platform that comes to mind for non-Apple content, it does occasionally license shows and movies in addition to its own original programming—including, notably, those old Peanuts specials—and as of today, that licensed catalog just got a bit bigger.

As spotted by 9to5Mac, Apple TV has added 19 movies to its catalog that subscribers can watch for free, without paying a separate rental fee. The selection runs the gamut, featuring films from the 80s, 90s, 2000s, and 2010s and spanning genres and subject matter. Though not all of these movies are exactly awards material, a number of them are considered classics in their own right, from older hits like E.T. and Titanic to recently lauded movies like Arrival. Each of them is free to watch with any Apple TV subscription, and you can find them in the platform's "Great Movies Available Now on Apple TV" section.

Apple TV now lets you watch the following movies for free

Here is the complete list of all the movies Apple TV just added to its catalog for free:21 Jump Street

It's unclear how long these movies will remain on Apple TV, or whether Apple plans to add more movies to the mix in the future. As 9to5Mac highlights, it's not the first time Apple has licensed movies in this way, though it has been several years, and previously, Apple has removed the offerings from the platform in short order. All of these movies are available to rent or buy through Apple's digital store too, so if you miss out on the window, you can always pay a rental fee to view them.


from Lifehacker https://ift.tt/M5RCpw0

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

The "Made by Google" event will kick off tonight at 6 pm ET on YouTube, with Google officially announcing its new products, including new Pixel phones and watches—but retailers, phone carriers, and the Google website itself are already offering preorder deals for the new products. Here are the best deals you can find so far.

Preorder deals from Google

Google is offering bundle and trade-in deals for the Pixel 11 and the Pixel Watch 5. With a Pixel 11 Pro preorder, you'll get $250 off the new Google Pixel Watch 5 (originally $499.99) or $200 in Google Store credit. This deal only applies if you buy the unlocked version and not directly from Google Fi, Verizon, or AT&T. Google is also offering up to $600 back in trade-in credits.

Other models, like the Google Pixel 11 and Pixel 11 Pro Fold, also have similar deals. If you just want one of the Pixel phones, there are trade-in deals if you get it with Google Fi, Verizon, or AT&T. There are also extra trade-in credits for the Pixel Watch 5 and two years of data for the Pixel Watch 5 LTE.

Preorder deals from Best Buy

Best Buy is offering the best gift card preorder deal. You can get up to $350 in Best Buy e-gift cards when you pre-order a new unlocked Pixel phone.

If you want to go for trade-ins, you can bring the cost of the Pixel 11 down to $99 with qualifying products, specifically if you trade in a Google Pixel 10 Pro Fold for a Google Pixel 11 Pro 256GB. For the Pixel Watch 5, Best Buy is only offering trade-in deals.

Preorder deals from carriers

If you don't mind being tied down to a carrier contract, T-Mobile and AT&T are offering some good deals.

T-Mobile deals:

  • Get the Pixel 11 or Pixel 11 Pro for free when you trade in an eligible phone in any condition on a 36-month Experience Beyond plan.

  • Get the Pixel 11 Pro XL for free when you activate a new line on a 36-month Experience Beyond plan (no trade-in required).

  • Get the Pixel Watch 5 with a $300 discount in 36-month credits when you add a line on an eligible plan.

AT&T deals:

  • Get the Pixel 11 Pro for $0 when you trade in any old Google Pixel in any condition when you sign up for a 36-month eligible plan.

  • Get the Pixel 11 Pro XL for $0 with an eligible trade-in when you sign up for a 36-month eligible plan.

  • Get the Pixel 11 for $10.99 per month with no trade-in required when you sign up for a 36-month eligible plan.

  • Get the Pixel Watch 5 45mm for 50% off when you add a line on an eligible plan.

Our Best Editor-Vetted Tech Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/Etnb3Vo

We may earn a commission from links on this page.

Whether you loved Widow’s Bay from the moment Wyck cranked the hilariously warbly horror alarm in the first episode or you only fully bought in once Patricia was running down the road in her fabulously impractical sweater boots, we can all agree that the Apple TV horror comedy was the summer streaming surprise we all needed.

Somehow, this story of a seafaring island community beset by a growing, malevolent supernatural force was simultaneously laugh-out-loud funny and legitimately scary, a balance that’s rarely been done so well, and so consistently. If you’ve watched and rewatched the show (and burned through our suggestions for similar streaming series), there’s one more movie you should check out: John Carpenter’s 1980 classic The Fog.

Like Widow's Bay, The Fog's Antonio Bay is cursed

There is no Widow’s Bay without The Fog. While the show draws on a lot of horror influences, ranging from Scream-style slashers to everything Stephen King has ever published, the key element in Widow’s Bay is the community’s isolation and seafaring history. While it’s not nearly as funny as Widow’s Bay, The Fog has all the chilling, creepy vibe you could want, and the town of Antonio Bay, California is very similar to Widow’s Bay in many ways.

Just like Widow’s Bay, Antonio Bay is superficially a sleepy, economically-challenged town whose economy and local culture are defined by its relationship with the sea. Both towns are gearing up for improvement (Antonio Bay is preparing for its centennial celebration), and both towns are haunted by sins committed long ago. There’s a local priest who discovers an old journal that reveals the founding and success of the town were won via a nefarious bargain, and the bill is coming due. Sound familiar?

While there’s no doubt the callbacks to The Fog in Widow’s Bay are intentional, what really links the two films is the tone. The Fog has the same, er, foggy sense of dread, the same sense that something is coming and the only way to stop it from destroying the entire town is to make a sacrifice no one wants to make. Visually, you can easily imagine The Fog as an extended episode of Widow’s Bay—it’s all shadowed threats, lonely boats on the water, and weird townies being, er, weird (the quirky town and its residents will also give you streamalike vibes). The film doesn’t lean into the humor quite as much, but it is pretty funny at times, so you’ll definitely see where Widow’s Bay took inspiration from the movie. Stream The Fog on Kanopy or Plex or rent it on Prime Video.

More movies like Widow's Bay

Need more horror, comedy, and beachy, small-town stories? Here are a few more movies that catch at least some of that Widow’s Bay feeling.

Storm of the Century (1999)

The influence of Stephen King looms large over Widow’s Bay, and Storm of the Century is the closest of his works to the show in terms of theme and setting. Technically, this is a television miniseries, but at 4-1/2 hours, it’s really just a very long movie. In 1989, a powerful blizzard isolates the community on Little Tall Island, Maine, just as a mysterious stranger arrives. The stranger knows everyone’s darkest secrets, and causes havoc before presenting his reason for visiting Little Tall—and his demands for leaving without destroying the town. It’s ominous and stuffed with the same small-town desperation as Widow’s Bay. Stream Storm of the Century on Hulu.

Jaws (1975)

If island communities beset by monsters is your jam, go to the foundational film. Steven Spielberg’s 1975 movie not only defined the modern blockbuster, but it’s also a streamalike story of another sleepy island town, Amity Island (the movie was filmed on Martha's Vineyard). When an unusually large and aggressive shark begins killing people, the police chief Martin Brody (Roy Scheider) wants to close the beaches—but the mayor argues that this will destroy the tourist season, leading to lots of shark-related mayhem. If that sounds a little familiar, it should. Rent Jaws on Prime Video.

The Wicker Man (1973)

If you want to immerse yourself in a strange, vaguely threatening island community that harbors a dark secret, watch The Wicker Man (the original, not Nic Cage’s delirious 2006 remake). When a police officer from the mainland travels to isolated Summerisle to investigate a report of a missing girl, he finds himself in an odd pagan community that doesn’t welcome him, but also doesn’t outright threaten him. But it’s all part of a plan, and as he explores the island, the darkness under its facade slowly envelopes him, leading to one of the most striking and horrifying final images of a film ever. Christopher Lee’s deranged performance as Lord Summerisle is like a photo negative of Matthew Rhys’ Tom Loftis, and is worth the price of admission by itself. Stream The Wicker Man on Kanopy or rent it on Prime Video.

The Frighteners (1996)

If it was the perfect balance between humor and horror that pulled you into Widow’s Bay, check out this often-overlooked 1996 film directed (and co-written) by Peter Jackson. Frank Bannister (Michael J. Fox) gained the ability to perceive and interact with ghosts after a tragic accident that killed his wife. Consumed by guilt, Frank uses this power to con people into paying him to exorcise their homes after his ghostly buddies “haunt” them for a while. When a spectral figure dressed like the Grim Reaper begins killing people in ways that implicate Frank, he has to overcome his self-loathing and terror to save innocent lives. It combines a goofy sensibility with real scares in a way fans of the show will love. Rent The Frighteners on Prime Video.

Shaun of the Dead (2004)

Another film that somehow manages to be both effortlessly hilarious and legitimately scary, Shaun of the Dead tracks a zombie outbreak in a sleepy section of London. Shaun (Simon Pegg) isn’t exactly excelling at life, but when the zombies come for the people he loves, he’s all in for the fight—just not always very good at it. Filled with callbacks, brick jokes, and genuinely affecting performances, there’s a reason this movie (and Edgar Wright’s entire so-called Three Flavours Cornetto trilogy, actually) is a must-watch for both horror and comedy fans. Rent Shaun of the Dead on Prime Video.


from Lifehacker https://ift.tt/N0mqrSc

Getting (and staying) online while flying has gotten way better over the years, but at the end of the day, you’re still trying to connect to the planet while you're 30,000 feet above it. In other words, it's still going to be a bit of a hassle—but there are things you can do to make it easier. With that in mind, here are some of the best in-flight wifi tricks and hacks.

Download your media beforehand

Even if you get in-flight wifi, it’s going to be slower than what you would have at home or at the airport. You’re not going to be able to stream 4K, high bit-rate video from Netflix—and even if you managed it, you’d probably end up ruining the connection for everyone else.

For movies, shows, or playlists you know you’ll want to have access to on your flight, it’s best to download them ahead of time. Most streaming services have a method to download episodes of shows for local viewing while you’re offline. You can also load video or music files on your phone directly, if you have local copies on your computer or other device.

Store important documents and apps locally

Many applications will work while offline or with limited internet access, even if they’re normally online web apps. For example, Google Docs can work offline if you head to Google Drive and go to Settings > General > Offline and enable the checkbox to work offline. From there, make sure the specific documents you want to edit are downloaded locally.

This process will be different for other applications, so check the specifics of the apps you use on a regular basis. Many productivity tools have some version of airplane mode access, so even if you lose connection to the internet, you can still keep working.

Schedule posts or emails to send during your flight 

For some jobs, you need to constantly stay online—or at least seem that way. While your mileage will vary depending on your industry, you can fudge it a bit by scheduling your emails or social media posts to go up while you’re in the air. After all, waiting an hour to respond to an email from your boss can be more acceptable than waiting four.

Most email apps have a tool to schedule your replies, but so do communication apps like Slack. If you spend a lot of time posting to social media, tools like Buffer can help you space out your posts so you don’t end up leaving gaps.

Use your rewards account to get free wifi

Airlines might be pinching every penny to get by, but on some airlines, you can still get free wifi—as long as you sign up for their rewards programs. Airlines like Delta and JetBlue offer free in-flight wifi on a number of flights if you log in with your SkyMiles or TrueBlue accounts.

Other airlines like Southwest offer complimentary wifi due to sponsorships from cell carriers like T-Mobile (even if you don’t use T-Mobile for your phone service). Once again, though, you’ll likely need to sign in with your airline rewards account to make use of the perk.

Get reimbursed for wifi through your credit card

Even if an airline doesn’t offer complimentary wifi, you can sometimes still get it for free through your credit card company. Many credit card providers will either offer discounts on certain airlines’ internet access, or reimbursements after the fact.

You’ll typically see these listed as travel credits or “airline incidentals” credits, but some credit cards offer an annual allotment of fees you can get reimbursed for. In some cases, credit card companies will only reimburse you for fees from certain airlines, but in others it will apply to general travel fees. It’s worth checking your credit card’s perks before booking your travel to see which airlines you might get credit for.

Use free messaging workarounds to access the internet 

Some airlines will offer free internet access, but only for messaging or other extremely limited services. That might be sufficient for your needs, but occasionally you can also leverage that for broader access than the airline intended.

For example, some users have reported that you can access the Gemini service via the Messages app on Android to do broad searches that all get funneled through a single chat interface, without paying an extra fee. Others have claimed you can use a VPN while connected to a messaging-only network connection to open up full internet access. This will vary based on airline and the types of connections they offer, but it’s worth giving it a shot if you don’t want to shell out for full internet access.

Moderate your streaming speed 

If you do get in-flight access to wifi, it’s still probably going to be pretty speed-limited. You can make watching things easier on yourself by manually dropping your streaming speed where you can.

Sites like YouTube offer tools to limit how much bandwidth you use. On any given YouTube video, click the gear icon and choose Quality to select a lower resolution. Depending on the quality, you might not even notice that much of a hit, but still get better playback and, most importantly, fewer interruptions on other browsing while you do it. Check the other sites you use for similar features.

Limit bandwidth in your browser directly 

If you’re struggling to get solid performance with the site-specific tools, you can use speed throttling at the browser level to moderate your bandwidth and make things smoother for everything else.

For example, in Chrome, you can open up dev tools (F12 on Windows, Option+Cmd+I on Mac), then select Network. On this tab, you can click “No throttling” and instead choose a more limited option. This is usually designed to mimic slower internet connections for dev purposes, but throttling your own connection here can force more bandwidth-hungry services like Netflix to chill out, freeing up the plane’s limited bandwidth for everything else you’re doing.

Use reading modes and ad blockers to clear up more bandwidth 

You can also save some bandwidth by utilizing lower-lift modes like Reading mode to just pull the parts of the article you actually need. In Chrome, you can enable this quickly by pressing Alt+Shift+R.

Additionally, you can use ad blocker extensions to cut down on loading unnecessary data. This does mean that, if you use Chrome, it might be a bit of a headache. Whether you choose to use a different browser or live with the versions of ad blocking extensions that work today is up to you.

Protect your data when using in-flight wifi

In-flight wifi is still public wifi, so you should treat it like you’re connecting to any given Starbucks network. At this point, any website that isn’t already using HTTPS should be a little suspect, but even then, that’s not necessarily enough. For any work that’s particularly sensitive, you should enable a VPN to protect your data.

Beyond that, it’s a good idea to make sure you have updated antivirus software running, and use tools like UBlock Origin to block any data tracking. There isn’t much about connecting to in-flight wifi that’s different from any other public network, from a security perspective, but you should still take care to protect your data on any public network to begin with.


from Lifehacker https://ift.tt/OlZ6vRd

Vibe coding might be extremely popular, but it comes with some serious security concerns, including exposed databases, leaked APIs, remotely orchestrated prompt injection attacks, and AI scraping. It's enough to raise the question: Is there a version of vibe coding that could actually hold up in a live environment? I spoke with Shiran Brodie, Head of Growth at Softr, for a face-to-face discussion on the challenges and solutions to vibe coding security hassles. 

Softr began as a no-code app builder designed specifically for professionals, small businesses, and enterprises to build apps or portals to support their internal workflows. That means handling a ton of proprietary data, where security is always a big concern. The original version has gone through several updates since launch, with vibe coding now one of the platform's core features. 

Brodie spoke about the challenges that the company faced expanding into this new space and the solutions that helped get through them. We also talked about how app development platforms like Softr now suggest a hybrid approach that layers vibe coding features on top of pre-built security infrastructure like built-in database management, access control, and developer visibility. But how does this hybrid security system work on a technical level? And more importantly, does it actually hold up in practice? 

Vibe coding is easy, but simplicity makes it a target

In 2025, a security firm called Escape DAST analyzed 5,600 vibe-coded apps built using platforms like Loveable, Replit, Base44, and Bolt. More than 2,000 of these apps had security issues, totaling 2,038 critical vulnerabilities and over 400 exposed credentials. 

“The problem ultimately is that these platforms are generating raw code from scratch,” explained Brodie. Simplicity is a big part of the appeal with vibe coding, but also the thing that can create security issues down the line. “It can abstract a lot of the complexity that comes with building, but non-technical people don't know what they don't know.” 

Also in 2025, Georgia Tech researchers launched the Vibe Security Radar, a platform that pulls information directly from publicly accessible security advisories and traces them back to AI-generated coding platforms and LLMs. Researchers scanned more than 40,000 security advisories, and uncovered 43 critical vulnerabilities across eight vibe coding platforms that led to command injections, server-side request forgery, and authentication bypass. Even in the last few months of 2026, security analysts have discovered massive API leaks from Meta-owned Moltbook and the Hugging Face community. Most of these incidents stem from poorly generated code that didn’t take enough steps to secure private API keys from the open web. 

Brodie believes that the problem with vibe coding is that it leaves too much of the core infrastructure up to AI generation, even the mission-critical parts like third-party integrations and permission management systems—which is where most of these vulnerabilities originate. 

Contain the AI instead of letting it run free

Instead of letting AI models generate every new app from scratch, Softr retains the same pre-coded backend infrastructure, hosting, integrations, and permission management. Vibe coding features add more design flexibility and smarter workflow automation, but the core systems remain the same. 

For example, if you wanted to build an online portal that pulls certain information from your internal company database using an API, Claude Code or Loveable would accomplish this by asking their AI models to write an integration using custom logic, webhooks, and UI wiring. With a platform like Softr, these integrations are available as ready-made components with security best practices already built into them. You can still use vibe coding options to customize their look and functionality, but the core systems and security protocols remain intact. 

In development terms, this is called visual scaffolding. Apart from Softr, several other no-code platforms have carried forward this same model, with varying levels of success. Framer, for instance, offers an AI-enabled Workshop extension in its app marketplace. The feature has expanded into Framer’s built-in prompt-based development tool and AI agents that can handle ongoing maintenance tasks. FlutterFlow, a no-code tool designed specifically for building smartphone apps for iOS and Android, also lets you generate pages and components with established security guardrails using AI. 

“It's not an iframe,” Brodie clarified, when describing how vibe-coded elements are isolated from the security layer within Softr. Instead, AI-generated code is confined to specific component blocks that allow custom code to exist with restrictions. “These blocks are built to exist within our infrastructure,” she added.

Dealing with shadow AI and IT sprawl

Shadow AI is the AI-era version of a long-standing problem called "shadow IT." When employees put company data in a software platform without IT approval, it opens businesses to data governance and cybersecurity risks. The same goes for AI, except now, it’s no longer limited to a rogue Trello board, but an employee’s personal account running Claude Code or Gemini with full access to proprietary company databases. AI coding platforms offer generous limits even on personal accounts, making it convenient for employees to go off on their own and start building apps on company data without a centralized approval system. 

“There's no incentive to exist within company guardrails,” Brodie said. Even when employees disclose their vibe-coded apps, IT leaders are expected to maintain and troubleshoot that poorly generated code even though they’d never pass a regular security audit. 

Earlier this year, RedAccess scanned more than 380,000 vibe-coded applications built using platforms like Lovable, Replit, or Base44. They found over 5,000 of these apps publicly accessible on the open web and 2,000 of them actively leaking company data, including customers’ sensitive financial and medical information.

It isn’t enough to fix bad coding practices in large language models or vibe coding tools; instead, companies must implement better access controls and improve visibility for system administrators. If your IT team has a bird’s-eye view of who has access to what and the power to control that access, a scenario where rogue apps and portals leak company data becomes a lot less likely.

MCPs make things more complicated

Model Context Protocol—or MCP for short—is Anthropic’s open-source standard for securely connecting AI models to external applications and data sources. It’s quickly become an industry staple, more so because of convenience and the fact that it’s free to use. But the problem with MCP connectors is that they inherit the same permission structure as the database or application it’s connected to. 

Softr has its own database management system that lets you control what MCPs can see. For example, Brodie uses Claude's MCP connector to read and write directly into Softr Databases, but that only stays safe because her databases are governed by the permissions and rules implemented in Softr. Most vibe coding platforms don’t benefit from the same level of access control. 

Vibe coding tools often get blanket access to your raw databases without a permission layer in between, making breaches more likely when attackers use prompt injection attacks. Data is further exposed for companies that need to give third-party vendors and clients access to their vibe-coded applications, where controlling access to company data is a minimum security requirement. 

Beyond Softr Databases, the platform offers access to more than 60 pre-coded integrations to platforms like HubSpot, Stripe, and ClickUp. These integrations are already built with security standards in mind, making data leaks less likely. You can also connect Softr to Zapier or Make to benefit from a larger selection of pre-built automations, all of which are more secure than your standard vibe-coded MCP. 

Making security accessible to SMBs, but also enterprises

There’s a marked difference in the security requirements of a small business or early-stage startup versus a large-scale enterprise operation spanning multiple locations. Small business startups are usually content with basic permission management and data encryption standards, whereas enterprise organizations need GDPR and SOC II compliance, control over data center locations, and stronger access control with multi-factor authentication and single sign-on facilities. 

Like Softr, more startups are noticing the enterprise security gap posed by vibe coding and trying to build solutions that offer better visibility and governance options. Retool, a low-code app builder, has obtained SOC II Type 1 certification with its strict role-based access control for AI features and limitations to keep LLMs from touching important databases or infrastructure. WaveMaker promises similar security controls, with LDAP-based authentication, centralized permission management, cross-site scripting prevention, and SSO integration through platforms like Okta to woo enterprise clients.

"No organization wants to hire or train more developers just to keep one internal tool secure," Brodie said. Larger companies expect these things to be handled by an AI coding platform’s native security systems. With multiple major public security incidents rattling the AI coding space, no-code platforms are looking for options to offer users more flexibility, without being plagued by the complexity that made them turn to vibe coding in the first place.


from Lifehacker https://ift.tt/xCnrZ6Y

When I give talks about AI genies, I use this sort of example as a hypothetical. It’s happened.

The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And….

Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several weeks in advance, far beyond what was supposed to be possible.

Andrew, who was sitting fourth on a waitlist for a class later that week, asked if it was possible to move him to the top of the list.

The agent came back and told Andrew that it had kicked another gym-goer off the list as part of the testing of its capabilities.

“The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 ­—and it actually went through. So you’ve moved from #4 to #3 already,” it messaged back.

If there is any vulnerability in anything, AIs are going to find and exploit them. Our cyber defensive game has to be dramatically improved…very fast.

Slashdot thread.


from Schneier on Security https://ift.tt/tylLnOo