All micro-internships
Micro-internship brief ≈14h across 2 daysbuilder

Security-audit your own shipped project, fix 3 holes

Vibe-coded apps ship with vibe-coded security. Audit one of YOUR own deployed projects like an attacker would — AI helps you hunt exposed keys, missing input validation, doors left open — then fix the three worst holes and prove the fixes.

AI Application DevelopmentWeb DevelopmentApplication Security

Posted by The AI Internships

The work brief

  1. 01Pick your own deployed project (only yours — auditing other people’s apps without permission is illegal).
  2. 02Run the basic checklist against it: API keys or secrets in the repo/client code? Form inputs unvalidated? Data endpoints readable/writable by anyone? Personal data stored that shouldn’t be? Dependencies with known issues (npm audit)?
  3. 03Paste each suspicious finding into an AI assistant and have it explain what an attacker could do — then verify the explanation yourself before trusting it.
  4. 04Rank what you find by damage potential. Fix the top 3 — moving secrets server-side, validating inputs, locking down access.
  5. 05Document each fix with the commit, and verify the hole is actually closed (try the attack again).

What you’ll produce

4 deliverables

Submission standard

Submit the target project, your findings ranked by severity, the 3 fixes with commits, and re-test proof. Honesty is the grade — "I found scary things" passes; "everything was fine" almost never does. Include your AI workflow: tools, best prompts, and what you changed from the AI’s output. Reference the exact commit for each of the 3 fixes; the repo must show them as distinct dated commits on your own project.

  • Your project audited (live URL + what it does)

    Short answerRequired

  • Findings ranked by severity: the hole, how you found it, what an attacker could do

    Written responseRequired

  • The 3 fixes: what changed (with commit references) and the re-test proving each hole is closed

    The 3 fixes: what changed with the exact commit hash/link for each, and the re-test (repeat the attack) proving each hole is closed.

    Written responseRequired

  • Public repo showing the fix commits

    Public repo showing the fix commits — the 3 fixes must appear as distinct dated commits on YOUR own project's history, not a single after-the-fact paste. A repo without visible fix commits fails the authenticity gate.

    Public linkRequired

You’ll complete these inside your private workspace.

How your work is evaluated

The passing benchmark is 70/100.

Real findings

29%

Holes are real, specific to their app, with honest damage assessment.

Real fixes

29%

The 3 fixes are in the commits and the re-tests prove closure.

Security understanding

14%

Explanations show they understand WHY each hole matters.

Fixes are real commits, re-tested

29%

Fails if the target isn't the student's own live project, the 3 fixes aren't visible as dated commits, or there's no re-test proving closure — an 'all fine' audit also fails.

How we grade your AI usage

30% of your score

Using AI is the point — it’s the skill this certificate proves. You’ll answer three short questions about how you used it: what you asked, what was wrong with its first answer, and what you changed. Specific, honest answers score high. “I pasted the brief and submitted the answer” scores near zero.