Thanks to AI, you can turn an idea for an app into a finished product over a weekend with little actual coding. But just because you got the code to do what you want it to doesn’t mean it’s safe to ship. What security risks should you watch out for? How can you vibe code safely? Here’s what you need to know.
The Slipups to Be Aware Of
Vibe coding doesn’t come with new and exotic threats that result from AI involvement. Rather, it creates opportunities for classic coding mistakes to slip through the cracks because no one bothered to review the code. Here are the usual suspects.
Broken authorization
A common vibe coding error is to create user access without considering wider authorization implications. The user can log into their account as intended, but they might also have access to admin functions or access data associated with other accounts. When authorization fails, it becomes trivial for attackers to escalate privileges and steal sensitive data.
Exposed or hardcoded secrets
Vibe coding is excellent for quick iteration. The inattentiveness that vibe coding enables also increases the chances of leaving secrets like credentials, API keys, or tokens exposed in user-facing code. Routing model calls through an AI gateway keeps keys on the server side rather than in code the client can read, so credentials are never shipped to the browser in the first place. Otherwise, exposed credentials can give attackers access to developer accounts, databases, third-party tools, and more.
SQL injection and XSS
AI can solve coding problems without understanding what inputs an attacker might control. This creates code that does what it’s supposed to do but remains vulnerable to injection attacks and cross-site scripting. Leaving this unaddressed lets attackers do everything from manipulating database queries to executing unwanted commands and even taking over parts of the application.
Unsafe dependencies
Some vibe coders follow their AI’s suggestions without questioning the need or reasons behind them. The AI might recommend that you need a third-party dependency and hallucinate one if the dependency doesn’t actually exist. Some attackers actually count on this and create fake harmful dependencies for devs to download. These get implemented and can do anything from stealing data to compromising the broader dev environment.
Missing security controls
An AI may just not include various security controls in the code it writes. This can be anything: a lack of rate limits, improper session handling, weak password policies, no input validation and sanitization, etc. The AI prioritizes feature implementation, not making sure that the code survives contact with a complex threat model.
Business logic vulnerabilities
Frustratingly, a vibe-coded app might pass standard functionality testing but still let attackers exploit faulty business logic. For example, it may let them keep claiming one-time discounts or request refunds without meeting the conditions. You end up losing money and having to patch vulnerabilities you didn’t even know were possible.
Keeping Quality High
You don’t have to give up AI-assisted speed and efficiency to boost code quality. You do have to adopt a few practical habits that counter the risks.
- Review code before shipping – Treat all AI-generated code as if another developer wrote it. Read it, understand what it does, and look for security and logic problems before merging it.
- Test beyond the happy path – Intentionally test for what happens if users don’t use features as intended or even maliciously.
- Check dependencies before installation – Make sure that AI-suggested dependencies actually exist and are maintained by reputable developers.
- Don’t take AI claims at face value – Treat AI recommendations as proposals, not definitive answers. Double-check assumptions and documentation before following AI advice, especially when it’s related to security.
- Establish security requirements up front – Rather than just focusing on functionality, tell the AI what security constraints it should work under from the beginning of every project.
