Securing the Apps Everyone Is Building with Roi Nisimi and Yonatan Levi

What happens when your marketing team, your sales team, and the person down the hall can all ship a full app from a single prompt? And what is that app quietly connected to? In this episode, Ron sits down with Roi Nisimi, Principal Security Researcher, and Yonatan Levi, AI Security Researcher, of Orca Security. They built apps on the most popular AppGen platforms and then tried to break into them. Ron, Roi, and Yonatan get into what's really running behind a prompt-built app, and what Orca's team found when they went looking for trouble. In one case, a single misconfigured app gave them a way into every integration connected to the workspace. They also explain why Supabase has become a favorite of builders and attackers alike, and share the security questions they ask before sending a prompt. The bigger tension is speed. With no code review between the prompt and production, Roi argues that velocity has broken the threat models that security relied on for years. And when the agent makes every decision, nobody fully understands what was built, not even the security researchers.

Impactful Moments

00:00 - Introduction 02:15 - Busting the vibe coding myth 04:40 - Inside Orca's State of AI report 05:55 - The unpatched AI SDK problem 07:40 - What is AppGen? 10:20 - Who builds the backend? 12:25 - Inside Orca's AppGen hackathon 14:10 - Thinking like a citizen developer 15:15 - Who's really building these apps 19:25 - One misconfigured app, every integration exposed 20:45 - Why Supabase is the holy grail 23:00 - Checking your own exposure 24:30 - Why the SDLC is breaking down 26:55 - Prompting for a secure app 28:15 - Don't hand the agent every decision 31:20 - Staying sharp by never stopping learning 33:35 - From protecting environments to protecting apps

Links

Connect with Roi Nisimi on LinkedIn: https://www.linkedin.com/in/roinisimi/

Connect with Yonatan Levi on LinkedIn: https://www.linkedin.com/in/yonatan-levi-b22168258/

Register for Orca’s virtual Builder Exchange: https://orca.security/builder-exchange/?utm_source=HVN&utm_medium=3rd-part

Read the security findings in Orca’s 2026 State of AI Security Report: https://orca.security/lp/2026-state-of-ai-security-report/?utm_source=HVN&utm_medium=3rd-party

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/