Michael Ly on Instagram: "Does your app have all these? #ai #claude #security #buildinpublic #vibecoding"
Verdict: Mostly accurate security checklist, with one oversimplified claim.
Credibility score: 84/100 · 10 claims checked · 9 accurate, 1 misleading, 0 false, 0 unsupported.
Instagram · Michael Ly · Unknown · Jul 25, 2026
The video lists common web app security best practices. Most are solid advice, but the API-key/origin claim is oversimplified.
Claim-by-claim breakdown
- Accurate (96% confidence): Apps should enforce proper access control so users cannot change an ID in the URL and access someone else’s data. OWASP recommends object-level authorization checks and warns against relying on user-controlled IDs in URLs.
- Misleading (72% confidence): An API should not accept random cross-site requests just because they come from a website other than your own. Security for browser-based requests depends on more than origin checks; CORS is not an authentication mechanism, and Stripe-style public keys are not secret credentials.
- Accurate (95% confidence): Updating packages is an important security practice. Dependency updates are a core defense against known vulnerabilities in third-party libraries.
- Accurate (96% confidence): File uploads should be checked for file type and size. OWASP recommends validating file type and controlling file size for uploads.
- Accurate (98% confidence): Database queries should be parameterized. OWASP recommends parameterized queries/prepared statements as the preferred protection against injection.
- Accurate (86% confidence): Login tokens are generally safer in secure, HttpOnly cookies than in localStorage. Secure/HttpOnly cookies are recommended for many session tokens; localStorage is readable by JavaScript and is more exposed to XSS.
- Accurate (98% confidence): Stripe webhooks should be verified before trusting them. Stripe documents signature verification as the correct way to authenticate webhook events.
- Accurate (90% confidence): Basic security headers should be enabled on a web app. OWASP provides a dedicated HTTP security headers cheat sheet recommending common protective headers.
- Accurate (97% confidence): An API should not return other users' information. OWASP access-control guidance emphasizes enforcing object-level authorization on every request.
- Accurate (74% confidence): Your account, hosting, database, and domain should all have two-factor authentication enabled where supported. 2FA is widely recommended for administrative accounts, but the exact availability and implementation vary by service.
More fact-checks
- Αρκουδέηδες on Instagram: "Σας αξίζει Μητσοτάκης μέχρι να σβήσει ο ήλιος ☀️" — Score 100/100
- Voice Of Nation by Himanshu Jangid on Instagram: "A Hindu girl living in a Muslim-majority area of Bhopal, Madhya Pradesh, reportedly faced an attack after a dispute involving her friend. According to reports, her friend parked his bike near a madrasa, where locals allegedly demanded ₹1,000. He said he was a student and couldn't afford to pay, after which he was reportedly assaulted. The incident drew members of Hindu organizations to the scene, and police later intervened. Reports say the girl was subsequently provided assistance by the police." — Score 68/100
- Meenakshi Sehrawat on Instagram: "Minorities पूरी दुनिया में क्या कर रही है ये जाने की ज़रूरत है भारत में तो हम देख ही रहे हैं लेकिन आज कोई देश से नहीं बच रहा इन minorities से! लेकिन वो लोग इसे इनसे अच्छे से डील कर रहे हैं!" — Score 48/100
- 2.7M views · 91K reactions | हिंदू विरोधी कांग्रेस के वो पाप जिन्हें माफ नहीं किया जा सकता? | Mahathugbandhan - महाठगबंधन — Score 34/100
- CJP || DELHI 🪳 on Instagram: "Tonight, @thv took a turn in the audience as he watched @gracieabrams and @dojacat perform at #Vogue World: Hollywood. No stranger to a fashion show either, the @bts.bighitofficial star dressed in a look that could have easily appeared on the runway" — Score 20/100
- Yash Juneja on Instagram: "Anti Paper Leak Bill Not passed in Parliament😵😱🫢😣 . @yashjunejavines @yashjunejavlogs . #bjp #cjp #congress #aap #politics" — Score 45/100
- Pakistan electricity bills and the 200-unit protected category — Score 64/100
- Four Layers of Color Theory for Product Design — Score 68/100
