How do you go about telling a person who vibe-coded a project into existence how to fix their security flaws?
I wish I was kidding but not really - they posted about it on X.