Vibe coding, the practice of creating software by describing it to an AI model rather than writing and reviewing every line manually, has become increasingly common in the technology industry. Its speed and accessibility can help people build with fewer resources, but code that is not fully understood or inspected can introduce security risks.
The cybersecurity company Apiiro said an analysis of Fortune 50 companies found that vibe coding made engineers four times more productive while producing ten times as many security issues. For beginners, the following practices can reduce some of the risks.
1. Write precise instructions and create a persistent security file
AI models may take shortcuts to satisfy a request without adding appropriate protections. Prompts should therefore specify privacy requirements, access restrictions, encryption and other security controls. Developers can also ask the model to consider the OWASP list of top vulnerabilities.
Many tools support persistent context or rules. A markdown file can contain the project's security requirements so the model considers them during future tasks. The source also recommends choosing tools with audit logs, which make it easier to track project changes.
2. Keep credentials out of prompts and source code
API keys and passwords should not be entered into an AI chat or embedded directly in code. If credentials are later pushed to GitHub, they could become visible to others. Restricting an AI tool's access can also help reduce the risk of prompt-injection attacks.
For beginners, the recommended approach is to store sensitive information in a password manager and use the secrets or environment-variable features provided by services such as Replit, Lovable or Vercel. When those features are unavailable, a backend .env file can be used, provided it is excluded through .gitignore and never exposed on the application's frontend. TruffleHog can help detect accidentally leaked secrets.
3. Protect application data
Applications that handle substantial amounts of data may rely on SQL databases, which can be targeted through SQL injection. Developers should instruct the AI to parameterize queries, sanitize inputs, use Server Actions for critical operations and enable row-level security with appropriate policies where applicable.
The source also advises checking that the project uses current versions of its libraries. AI systems can suggest packages that do not exist or may inadvertently introduce malicious dependencies, so generated recommendations should be checked before they are adopted.
4. Add rate limiting
Rate limiting restricts how often a user or automated system can perform an action. It can help reduce denial-of-service activity, brute-force password attacks and credential-stuffing attempts.
The appropriate limits depend on the application. A support chatbot, for example, could use limits on the number of tokens consumed per user each day. Where possible, the source recommends limiting activity by account ID before using IP addresses, making it more difficult to bypass controls with a VPN. Email or phone verification flows and CAPTCHA can provide additional protection against unwanted activity.
5. Review and test the generated code
A professional software review is preferable, but developers can also ask an AI model to search for vulnerabilities and test the project against the OWASP Top 10. Using a different model for a second review may reveal issues missed by the first one.
The source lists several tools designed to assess AI-generated projects, including Claude Code Security, Codex Security, Stackhawk's Wingman, CheckVibe, SafeToShip and the Vibe App Scanner. Security checks should continue after launch, since monitoring is needed to identify new problems in a deployed application.
Sources: Engadget.