DRAWAFISH.COM POSTMORTEM — AUG 3, 2025 INCIDENT

Summary from the TLDR Web Dev newsletter

The creator of DrawAFish.com, after getting Hacker News fame through vibe-coding and heavy reliance on Copilot, had a security incident involving username vandalism and offensive content due to a legacy password breach, lack of authentication in the username update API, and a JWT vulnerability.