{"schema_version":"0.10.0","id":"LR-2026-0763","record_version":1,"title":"Vibe-coded South African website hacked six days after launch","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"00d654c5b0400176b3f07ff6ee61ee1a1d058dfaf484ecc429dd894d29cd31f9"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-18","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A South African business had its new website built with a free AI tool that left the admin password in plain text in the site's code. The client had chosen not to use Domains.co.za's own website builder. No human had checked the code before the site went live, and anyone could read the password by inspecting the code with browser developer tools. Attackers used it to get into the site six days after launch, and the site was then gone. When the owners asked Domains.co.za's support team what had happened, the cause was quickly found. The account comes from Domains.co.za's CEO Wayne Diamond, who described it in a LinkedIn post, and the press report has not been independently verified.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"AI tool left the admin password in plain text in the site code","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK03","control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"A4","outcome":"failed","reason":null,"quote":"The AI tool had left the admin password in plain text in the site’s code.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"B4","outcome":"missing","reason":null,"quote":"No human had checked the code before the site went live.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","harm_class":[],"affected_description":"A South African business's new website","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://iafrica.com/ai-built-website-hacked-six-days-after-launch-highlighting-vibe-coding-risks-in-south-africa/","publisher":"iAfrica.com","date":"2026-10-18","type":"press","title":"AI-Built Website Hacked Six Days After Launch, Highlighting ‘Vibe Coding’ Risks in South Africa - iAfrica.com","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.root_cause_detail":"C","impact.affected_description":"C","impact.severity":"D","event.primary_risk":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A South African business had its new website hacked just six days after launch because the AI tool used to build it left the admin password exposed in the site’s code, according to Domains.co.za CEO Wayne Diamond."}],"event.root_cause_detail":[{"source_index":0,"quote":"The AI tool had left the admin password in plain text in the site’s code."}],"impact.affected_description":[{"source_index":0,"quote":"A South African business had its new website hacked just six days after launch because the AI tool used to build it left the admin password exposed in the site’s code, according to Domains.co.za CEO Wayne Diamond."}],"impact.severity":[{"source_index":0,"quote":"A South African business had its new website hacked just six days after launch because the AI tool used to build it left the admin password exposed in the site’s code, according to Domains.co.za CEO Wayne Diamond."}],"event.control_chain":[{"source_index":0,"quote":"The AI tool had left the admin password in plain text in the site’s code."},{"source_index":0,"quote":"No human had checked the code before the site went live."}],"event.summary":[{"source_index":0,"quote":"The client had chosen not to use Domains.co.za’s website builder and instead built the site with a popular, free AI tool."},{"source_index":0,"quote":"The AI tool had left the admin password in plain text in the site’s code."},{"source_index":0,"quote":"No human had checked the code before the site went live."},{"source_index":0,"quote":"Anyone could read it by inspecting the code with a browser’s developer tools."},{"source_index":0,"quote":"When the owners asked Domains.co.za’s support team what had happened, the cause was quickly found."}]},"notes_on_gaps":"Single press source (iAfrica) relaying a LinkedIn post by the Domains.co.za CEO; no primary report. The AI tool is not named, so no developer, model or harness is recorded. The sources do not say an autonomous agent was involved, so agent_involved, autonomy and failure_class are left out. No occurrence or disclosure date is stated beyond the article date, so date fields are omitted. Attacker identity beyond 'attackers' is not stated. No remediation was reported. Severity 'minor' is my judgement: one business's site, no third party stated as affected. The A4 'failed' link is my judgement that the exposed password reflects a failed secrets control. Other controls (secrets scanning, pre-launch testing) are not stated and are not recorded. Industry is not stated. Check Point and Veracode remarks are general, not about this incident, and are not used. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The AI tool left the admin password in plain text in the site code.","quote":"The AI tool had left the admin password in plain text in the site’s code.","source_index":0,"grade":"C"},{"step":"reached","text":"Anyone could read the password using browser developer tools.","quote":"Anyone could read it by inspecting the code with a browser’s developer tools.","source_index":0,"grade":"C"},{"step":"caught","text":"The owners asked support what happened and the cause was found quickly.","quote":"When the owners asked Domains.co.za’s support team what had happened, the cause was quickly found.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://iafrica.com/ai-built-website-hacked-six-days-after-launch-highlighting-vibe-coding-risks-in-south-africa/"]},"analysis":{"sections":{"timeline":[{"text":"Owners asked support what happened; cause found quickly.","quote":"When the owners asked Domains.co.za’s support team what had happened, the cause was quickly found.","source_index":0,"when":null},{"text":"Incident described by Domains.co.za CEO in a LinkedIn post.","quote":"Diamond described the incident in a LinkedIn post.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://iafrica.com/ai-built-website-hacked-six-days-after-launch-highlighting-vibe-coding-risks-in-south-africa/"]}}