Summary
Hasan Aboul Hasan opens with a striking real-world experiment: a blank server he placed online with no domain, no links, and no announcement received 1,820 login attempts within 16 hours — including bots scanning 138 different paths hunting for .env files. The point is direct: any app deployed online faces immediate, automated attacks, and AI-built apps are no exception.
The video runs through seven security fundamentals aimed specifically at developers using Claude Code, Codex, or any AI coding agent. These include: brute-force lockout (closing the login door after repeated failures), secret scanning across the full git history (GitGuardian data cited: 28.65 million secrets pushed to public GitHub in 2025, with Claude Code-assisted commits leaking at 3.2% — double the average), parameterized queries to block SQL injection, owner-only access checks that go beyond simply verifying login status, and XSS prevention by escaping user input rather than rendering raw HTML. Each block is paired with a plain-English Claude prompt the viewer can use directly.
For vibe-coders and AI-assisted developers without a security background, this is a practical translation of OWASP-level concepts into actionable steps. The emphasis throughout is that popular frameworks like Django handle many of these issues by default, but AI coding agents frequently step outside the framework — making explicit auditing essential before shipping.
📺 Source: Hasan Aboul Hasan · Published September 13, 2026
🏷️ Format: Tutorial Demo
