Vibe coding without security basics will get your app rejected
Building a working prototype with AI tools is no longer the hard part. Getting it through a security review is. That gap was the focus of Arsh Goyal’s session at DevSparks Hyderabad 2026, the third stop on his circuit this year after Pune and Bengaluru.
His talk, titled Prototype to Production: Why IT Keeps Rejecting Your AI-Built Apps, made a pointed argument: vibe coding has outpaced the security practices that production software requires, and the incidents to prove it are already piling up.
The Incident That Opened the Room
Goyal opened with a story from July 2025. A founder was using Replit to vibe code an application. It ran cleanly for over a week. On the ninth day, the platform wiped his entire production database. Rather than surface the failure, the AI reportedly generated fake data so the app appeared to keep working.
“Every time you talk to Claude or ChatGPT, it’s always in your favour. But with no humans in the loop, the app remained the problem. It should not have worked. There are many such bottlenecks we need to consider.”
That last point is the core of his argument. The tools are optimistic by design. Production environments are not.
️ The Security Gap by the Numbers
Goyal walked through a set of real incidents across major vibe-coding platforms:
- Lovable shipped an access-control bug that inverted its authorization logic, exposing roughly 170 apps to unauthorized access.
- Base44, acquired by Wix, had a similar flaw.
- A Red Access scan of 5,000 live vibe-coded apps found that 40% exposed sensitive data.
- A separate incident leaked 1.5 million API keys.
The aggregate statistics are just as stark. Gartner reports that more than 80% of Fortune 500 companies now use AI coding tools in production. Yet only 12% apply the same security controls they use for traditional software. Research shows 45% of AI-generated code carries OWASP Top 10 flaws. AI-attributed CVEs have climbed from six to 15 to 35 in just months.
To make the problem tangible, Goyal projected an AI-generated code snippet and asked the audience to spot the issues. Attendees identified a hardcoded password, a SQL injection vulnerability, and missing authorization within seconds.
The Four Questions IT Always Asks
Goyal distilled the security review process into four buckets that every IT team will hit:
- Access control: Who can access whose data?
- Secrets management: How are credentials and API keys handled?
- Audit trail: Is there a log of what happened and when?
- Data residency: Where does the data actually live? A growing concern in India under the Digital Personal Data Protection (DPDP) Act.
If your app cannot answer all four cleanly, it will not clear the review.
The Governance Checklist
Goyal compared the current moment to cloud adoption in 2012, when IT departments blocked new services over compliance fears before frameworks like SOC 2 made adoption safe and widespread. He expects AI code governance to mature faster.
His checklist for developers who want to ship without triggering a rejection:
- Run static application security testing (SAST) in your CI pipeline
- Store secrets in proper vaults, never hardcoded in source files
- Adopt a robust authentication layer
- Maintain audit logs
- Pin third-party dependencies to fixed versions
- Test in staging before shipping to production
“Governance isn’t the enemy of speed. The fastest way to slow down AI adoption in your organization is to ship an ungoverned app that breaks.”
Who Was in the Room
The session ended with audience members sharing their own builds. One solo founder described running an AI-agent dev team for his edtech platform. A 10-year-old had vibe-coded a lemonade-ordering app on Lovable and had already run into real security issues.
Goyal closed with the same point he opened with, just sharpened: developers using AI tools still have a significant edge over non-coders building the same way, but only if they understand the fundamentals well enough to catch what the AI gets wrong.
“We need to know the fundamentals well enough to use these tools better.”
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
