Adding security prompts to AI-generated apps cuts flaws by half
If you use an AI coding assistant to ship web apps, one small habit could cut your security exposure by more than half: ask the model to follow security best practices in your prompt.
Researcher Darko Androcec tested exactly this. The study generated six functionally distinct web applications using the same agentic coding assistant and model version, each built twice. Variant A used a baseline prompt. Variant B was identical except for an appended security-requirements section. Both were generated in a single, non-iterative round.
What the Study Found
All twelve programs were analyzed using static, dependency, dynamic, and manual testing techniques. Out of 85 candidate findings, 75 were confirmed. The breakdown by prompt type is stark:
- Baseline (no security prompt): 51 confirmed findings
- Security-aware prompt: 24 confirmed findings
The security-aware variant produced fewer confirmed findings in every one of the six applications. More importantly, it contained no Critical or High severity issues. The most severe finding in the security-aware set was only caught through manual testing, not automated scanning.
The Operator Takeaway
The study is small and each variant was generated only once, so the authors are careful to describe these as descriptive observations rather than statistically established effects. They position it as a preliminary study, with plans to scale the pipeline across multiple models and repeated runs.
Even so, the directional signal is clear enough to act on today. Adding a security requirements block to your vibe-coding prompts costs you nothing and appears to meaningfully reduce the attack surface of what gets generated. If you are shipping AI-generated apps anywhere near real users or real data, this is the lowest-effort risk reduction available.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
