Topic guide

Vibe Coding Security

AI coding tools produce working applications quickly, and they produce a consistent set of security gaps while doing it. This page explains what those gaps are, why they recur, and where to start looking in your own app.

Why the same problems keep appearing

An AI assistant is rewarded for code that runs. Ask for a page that lists records from a database and the shortest working path is to query the database from the component that renders the list — which means the credentials have to be in the browser.

The result works. It looks correct in review. Nothing in testing flags it, because the application behaves identically whether or not row-level security is enabled or an ownership check exists. Security controls are only visible by their absence when someone goes looking.

The twelve classes

Across apps built with different tools, the same twelve categories recur: exposed secrets, missing row-level security, broken authorization and IDOR, weak authentication, injection, cross-site scripting, insecure uploads, SSRF and webhook forgery, missing rate limits, prompt injection, CORS and header misconfiguration, and dependency risk.

They are not equally urgent. Four of them — secrets in the bundle, missing row-level security, missing ownership checks, and unmetered endpoints — account for most of what actually causes damage, because they expose data or spend money without an attacker needing any particular skill.

Where to start

Check what your build actually shipped rather than what your source says. Query your database for tables with row-level security disabled. Request another user's record by ID while logged in as yourself. Hit an expensive endpoint fifty times and count the successes.

Each of those produces evidence in minutes, and evidence is the point — intent and code review both miss this category of bug routinely.

Questions

Common questions

What is vibe coding?

Building software primarily by prompting an AI tool rather than writing the code yourself, using tools like Lovable, Cursor, Bolt, v0, Replit or Claude Code.

Is AI-generated code less secure than hand-written code?

Not inherently, but it fails in more predictable ways. AI tools optimise for code that runs, and most security controls are invisible when absent — the application behaves identically with authorization missing, so nothing in normal testing surfaces the gap.

Where should I start?

With secrets in your client bundle, row-level security, ownership checks on ID-based endpoints, and rate limits on expensive endpoints. Those four account for most of the serious findings.

The complete guide

All twelve classes, with the fix and the prompt for each

108 pages, 41 copy-paste prompts, and a 40-point pre-launch checklist.

Get the guide