MyBroadband reported last week that a client of domain registrar Domains.co.za had a newly launched website compromised six days after it went live. The site had been built with an AI coding tool rather than a conventional website builder.
The account comes from a LinkedIn post by Domains.co.za chief executive Wayne Diamond. He described the site as looking good but not doing much else, and then being gone. The cause was not exotic. According to Diamond, the AI tool had left the site’s administrator password in the page code in plain text, where anyone could read it with a browser developer tool.
“No sophisticated attack. No zero-day exploit. The attackers just read the password and walked in through the front door.”
Wayne Diamond, CEO of Domains.co.za, quoted by MyBroadband
The speed is the new part
Hardcoded credentials are among the oldest mistakes in web development. What has changed is how quickly they are found. Diamond’s point was that attackers know which mistakes AI tools tend to make and run automated scans for exactly those patterns around the clock. A site can go from launch to compromise inside a week without anyone targeting the business specifically.
Writing for CIO South Africa, Wits Business School research director Rennie Naidoo cites research from Veracode and academic studies finding that nearly half of AI-generated code contains known vulnerabilities. His description of the underlying behaviour is worth repeating: accepting AI-generated code with minimal scrutiny, trusting it to run without checking it for flaws.
His analogy is a good one. It is like flying on autopilot without checking the instruments. It works brilliantly, until it does not.
This is not an argument against building with AI
We host a good deal of software that was built quickly, some of it with AI assistance, and the productivity gain is real. The problem is not the code generator. It is that building and shipping used to be separated by people who asked awkward questions, and on many projects that gap has closed to nothing.
A few habits reopen it:
- Never let a secret reach the browser. Credentials, API keys and tokens belong in server-side environment variables, not in anything the client downloads. View your own page source and search it before you launch.
- Assume the URL is public. Unlisted is not private, as the next article in this series shows.
- Put something in front of the server. A next-generation firewall will not fix a hardcoded password, but it does blunt the automated scanning that finds one.
- Have a restore path. The site in this story was gone. A daily backup turns that from a catastrophe into an afternoon.
- Get a second pair of eyes before go-live. Even a brief review by someone who did not write the code catches this class of mistake.
Where we fit
Our Coolify VPS hosting exists for this situation: you have built something, it works, and it needs a real home. You get a private server in a South African datacentre behind a next-generation firewall, automatic SSL, and seven daily backups of the whole machine that we manage.
That does not review your code for you. It does mean a bad day is recoverable, and that your application is not sitting unhardened on the open internet while the scanners work through it.
Source: MyBroadband, 18 October 2026. The AI tool involved was not named.