A Security Disaster in a Vibe-Coded Patient Management App

A healthcare staff member built a patient management system directly using an AI coding agent, leaving patient data essentially exposed with no protection.

Existing patient data was imported as-is and uploaded to the internet, then consultation recordings were added on top and sent to two AI services, which ran automatic summarization. The data was exposed without encryption, and the author was able to obtain read/write access within 30 minutes.

When the issue was reported, the response that came back was not from a person but an AI-generated automated audit message.

The technical implementation was flimsy as well.

• The application consisted of a single HTML file, with all JavaScript/CSS/structural code inline.
• Access control existed only in client-side JavaScript, with no server-side enforcement, meaning data could be accessed with a single curl command.
• The backend was a managed database service with no access control, and all voice recordings were sent directly to an external AI API.

Operationally, it was riddled with problems too.

• Data was stored on US servers.
• It operated without a DPA (Data Processing Agreement).
• Patients were not notified in advance that their data would be processed.

The author believes this setup likely violated Switzerland's nDSG data protection law and professional confidentiality obligations (Berufsgeheimnis). The conclusion is clear: even when using AI coding tools, if you don't understand architecture, security, and data processing responsibility, you end up building not fast software but an unsafe system.