I have an agent whose only job is to hack my own app.

And it’s the reason my app never had a single security incident.

If you’ve also shipped a vibe coded app, you need to set up this agent ASAP. And if you’re still in the process of vibe coding one, this is a security practice you 100% want to do.

But why would a working app need an agent attacking it?

Because deploying a vibe coded app doesn’t just publish it for your users to see.

It also exposes the easiest way to hit your app from the outside: your API routes (the addresses anyone outside your app can use to reach your data).

Nobody warns you about this, because most tutorials stop at “it works.”

Which is why I want to help you set up a loop that checks those routes for you, without you ever needing to touch it.

1. Run a /loop in Claude Code

In case you didn’t know, Claude Code has a /loop skill built in.

And this skill makes it possible to get work done even when you’re nowhere near your keyboard.

That’s because you set it up once, and it runs the same job over and over on its own.

Here’s everything you have to feed it:

1. The amount of time between runs
2. And the task you want it to run on that schedule

So go ahead and run /loop now.

2. Set the time interval

Any interval works here. If you want to, you can even run it every 5 minutes.

But if you’re actively shipping app features, once a day is the least amount of time you should set.

That’s because a daily run catches what last week’s changes broke (without burning tokens all night).

3. Point the loop at your own API endpoints

After you’ve set up the interval, you need to set the task.

Which is also pretty simple. You just have to describe it in one plain sentence.

Here’s the prompt I use:

So as you can see, I’m not telling Claude Code what to look for.

That’s the loop’s job.

And it does that on every single endpoint in your app.

Because all it takes is one of them to let somebody in and wipe your database.

4. Tell it to write what it found along with the fix for each item

Each time the loop runs, it should give you a report so you can double-check it.

Because if you only set up a phone alert, it’s likely you will just swipe it away.

And that’s not the point.

But reading a report and fixing what’s inside it are 2 different jobs…

5. Run a second loop that reads the report and applies fixes

This is the step almost everyone skips.

The first loop is for finding the holes.

And the second one should read the report, verify whether each issue is real, and then fix it.

Btw, this is why we got the verify step above…

You don’t want an agent rewriting your API routes off a list nobody checked.

6. Start both loops again every session

One thing to know: a loop lives inside the session you start it in.

Close the session, and it’s gone.

So make it a habit. Every time you open Claude Code to ship something, fire both loops first, then start working. Takes 10 seconds.

Want to know why Creator Buddy has been live since January 2025 without a single security incident?

Because I’ve had agents pounding its API endpoints that entire time.

Not because I set something up once and forgot about it. Because every new feature you ship opens new API routes, and I check them every time.

You’ve put a lot of effort into your vibe coded app…

So go make sure nobody else can get in.

Btw, maybe your app is live right now (or you’re in the process of coding one) and you have no idea whether it’s actually secure.

Every week I run a live session inside the Vibe Coding Academy, where 830+ members are shipping their own apps. Just bring the app, and we’ll set up and fix everything together.

​Join the Vibe Coding Academy here.​

Keep shipping,

Alex