How I Patched the 2 Main Cybersecurity Vulnerabilities of Detox Mental

Of all the people in the world, the person I talk to most about AI is probably the last one you’d expect: my mother.

Currently in her 60s, she’s an entrepreneur with over 30 years of experience, who emigrated from Venezuela to the USA in her 50s and who is currently running a successful business there. 

She has an innate and relentless curiosity, and her latest obsession is none other than Artificial Intelligence (even when she’s not a technical person). I couldn’t be more proud.

In our talks, we often discuss the uncertainty of the job market in tech, and one of her recent pieces of advice stuck with me:

“You should start thinking about Cybersecurity.”

I’m currently building Detox Mental: an app to help users reflect on their inner monologues by building a journaling practice. Since I’m an obedient son, I decided to take her advice and start my Cybersecurity experiment here.

I proceeded to run two audits on the app to find vulnerabilities: one with Grok 4.6 and another with Claude Opus 5.5.

In both cases, the following two came up as the most urgent:

1. The paid audio course from the app could be unlocked for free (Broken Access Control).
2. There were no limits on the usage of external paid services, namely Resend and Hugging Face (Denial of Wallet).

These two issues were addressed in three steps:

1. Plans created with a high-end model:

Opus 5.5 analyzed the relevant code and prepared detailed plans to resolve each of the vulnerabilities. The Denial of Wallet issues were too large for a single plan, so we divided them into three separate tasks (4 tasks in total).

2. Execution with a middle-end model:

To reduce costs, I used Sonnet 5.5 to implement the plans provided by Opus. It was more than capable to do it excellently.

3. An intensive round of smoke testing:

When each update was completed, it was thoroughly tested in pre-production, confirmed, deployed to production, and tested again in the live app.

The two main vulnerabilities are now patched, and this opens the door to investigate more ways to make Detox Mental even more secure and trusted by users.

Cybersecurity is already an important topic and everything points to it becoming even more crucial in the years to come, mainly due to the advent of AI.

LLMs are already good at finding vulnerabilities and helping to fix them. As builders, we should keep an eye on the growing risks of the digital world and audit our projects regularly. 

This should become a habit that we all engage with. Instead of only building like crazy, from time to time we should stop, take a deep breath, and confirm that there are no data leaks or open doors that attackers can take advantage of.

As the wise say, “better safe than sorry.”

Or even better, as directly translated from Spanish, “better to prevent than to regret.”