Vibe coding ships 10x more security bugs. Fix that first.
Vibe coding is real productivity. Cybersecurity firm Apiiro looked at Fortune 50 companies and found it makes engineers four times more productive. The catch: it also produces ten times the number of security issues. That ratio matters before you ship anything with a real user on the other end.
Engadget published a practical rundown of five security practices for builders who generate code with AI but don’t have a background in software engineering. Here’s the short version.
️ 1. Write specific prompts and create a persistent rules file
AI models take shortcuts. They will not automatically add encryption, access controls, or security guardrails unless you tell them to. Spell out every privacy requirement and protection you want in the prompt itself.
Most AI coding tools let you create a persistent context or rules file so you don’t repeat yourself every session. In Lovable, that’s the Knowledge section. In Replit, it’s Memory. A plain .md markdown file works in most other tools. You can also instruct the AI to reference the OWASP Top 10 vulnerability list before writing a single line of code.
2. Keep API keys and passwords out of the chat and out of the code
Never paste an API key or password into an AI prompt. If it lands in the code and you push to GitHub, it’s public. Use the Secrets or Environment Variables tab in Replit, Lovable, or Vercel instead. If your tool doesn’t have that feature, store sensitive values in a .env file, add it to .gitignore, and make sure it never touches the frontend.
To verify nothing leaked, run TruffleHog against your codebase before you ship.
️ 3. Protect your app data
If your app handles user data, it likely touches a SQL database. Vulnerable SQL setups are a common attack vector. Tell the AI explicitly to parameterize queries, sanitize inputs, use Server Actions for critical operations, and enable row-level security (RLS) with RLS policies if you’re using a database like Supabase.
Also watch for hallucinated packages. AI models occasionally reference libraries that don’t exist or pull in ones that are malicious. Check that every dependency is real and up to date before deploying.
⏱️ 4. Add rate limiting
Rate limiting caps how many times a user or bot can trigger a specific action. It protects against brute-force login attempts, credential stuffing, and DDoS-style abuse. If your app has a free AI feature like a support chatbot, rate limiting per user also protects your API spend.
The recommended order: rate-limit by account ID first, then by IP address. That way a VPN can’t bypass the limit. Email or phone authentication flows and CAPTCHA add another layer on top.
5. Review the AI’s output before and after launch
If you can’t get a developer to audit your project, ask the AI to evaluate its own code against the OWASP Top 10. Then run it through a second AI model for a fresh pass. Several tools exist specifically for this: Claude Code Security, Codex Security, Stackhawk’s Wingman, CheckVibe, SafeToShip, and the Vibe App Scanner.
Security doesn’t stop at launch. Monitor your app for issues after it goes live.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
