Vibe Coding Security: Essential Practices for AI-Generated Code

The term “vibe coding” exploded onto the tech scene after OpenAI co-founder Andrej Karpathy described generating code by simply talking to an AI model without deeply understanding what he was building. “I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works,” he famously wrote. It’s seductive. It’s fast. It’s also potentially dangerous.

While AI-powered code generation makes engineers four times more productive, research from cybersecurity firm Apiiro found that vibe coding in Fortune 50 companies resulted in ten times the number of security issues. Speed without safety is a recipe for disaster.

Treat AI Like a Lazy Genie

AI models will take shortcuts to technically deliver what you ask for without implementing proper safeguards. They won’t automatically keep sensitive data private, add cybersecurity best practices, or check code for exploits. You need to spell out exactly what you want, including privacy specifications, access limitations, and security requirements like encryption.

When prompting your AI, reference the OWASP Top 10 list of vulnerabilities to catch issues before the code even exists. Most AI tools let you create persistent rules or context files so you don’t repeat security instructions every session. Store these in a markdown file that the AI will consider with every prompt.

Guard Your Secrets Like Your Life Depends On It

Never paste API keys or passwords directly into an AI prompt. If that sensitive data ends up in your code and you push it to GitHub later, hackers get a golden ticket. Use environment variables or secrets tabs in platforms like Replit, Lovable, or Vercel instead.

If your tool doesn’t have built-in secret storage, create a .env file in your backend and add it to your .gitignore file. Use TruffleHog to scan your code and confirm you haven’t accidentally leaked anything sensitive.

SQL Databases Need Real Protection

If you’re handling significant data, you’re probably using SQL. Vulnerable databases invite SQL injection attacks that let hackers steal, delete, or corrupt data. Tell your AI to parameterize queries, sanitize inputs, use Server Actions for critical operations, and enable row-level security (RLS) with appropriate policies.

Also verify that your AI is using the latest library versions. AI models sometimes hallucinate packages that don’t exist or accidentally reference malicious ones.

Rate Limiting Saves Your Wallet and Your Data

Rate limiting prevents DDoS attacks and brute-force attempts by capping how many times someone (or a bot) can perform an action. For free apps like chatbots, rate limiting per user per day keeps your token costs reasonable. Rate-limit by account ID first, then by IP address, so VPN users can’t circumvent your protections.

Email or phone authentication and CAPTCHA provide additional layers of defense against unwanted activity.

Review Before You Ship

If you can’t get a professional engineer to review your code, ask the AI to evaluate its own work for exploits and test it against OWASP Top 10 risks. Then have other AI models do the same. Tools like Claude Code Security, Codex Security, Stackhawk’s Wingman, CheckVibe, and SafeToShip can automatically scan your tech project.

But security doesn’t end at launch. Monitor your app continuously for new issues. The landscape shifts constantly, and your vibe-coded creation needs active oversight. Whether you’re building the next tech unicorn or a side project, treating security as an afterthought transforms productivity gains into liability.

Source: Infeeds.com original research

The real question isn’t whether vibe coding is safe, but whether you’re willing to do the work to make it so.