Securing AI-Generated Code: Risks of Vibe Coding

AI coding assistants and app builders let teams ship faster than ever, and let people with little programming experience build working products in days. Working is not the same as secure. AI-generated code tends to optimise for "it runs," and security often gets skipped.

The most common issues we see

Missing authorisation

The single most common problem. Generated endpoints fetch records by ID with no ownership check:

app.get("/api/notes/:id", async (req, res) => {
  res.json(await db.note.findUnique({ where: { id: req.params.id } }));
});

Any user, or anyone at all, can read any note. See our IDOR guide.

Secrets in client-side code

Assistants frequently put API keys for databases, payment providers or AI models directly in frontend code, or in environment variables that the framework exposes to the browser.

Backend-as-a-service without security rules

Apps built on hosted databases often ship with permissive rules or row-level security disabled, so anyone with the public key can read or write every table.

Mass assignment

Handlers like update({ data: req.body }) let users set their own role, plan or credits.

Injection

String-built SQL queries, shell commands built from input, and raw HTML rendering of user content.

Outdated or invented dependencies

Assistants may suggest outdated packages with known vulnerabilities, or package names that do not exist, which attackers can register. This is sometimes called "slopsquatting."

Missing basics

No rate limiting, verbose errors, debug mode on, permissive CORS, and no input validation.

Why it happens

• Prompts describe features, not security requirements.
• Generated code is tested by clicking through the happy path, where authorisation bugs are invisible.
• Assistants generate code that matches common examples, which often omit security.
• Speed reduces review.

How to ship AI-built apps safely

1. Ask for security explicitly: "Every endpoint must check that the current user owns the resource."
2. Use a central authorisation layer and instruct the assistant to use it.
3. Enable database-level protections, such as row-level security, and verify rules with tests.
4. Keep secrets server-side. Review what your build exposes to the browser.
5. Validate input with schemas and reject unknown fields.
6. Verify every suggested package exists, is maintained and is the one you meant.
7. Review diffs, using a security checklist for endpoints and data access.
8. Test the running app with two user accounts, trying to access each other's data.

Test what was built, not what was intended

Code review helps, but the fastest way to know whether an AI-built app is secure is to attack it. SecurityInfinity agents test your deployed app and APIs with multiple identities, check for exposed keys and open database rules, and give the exact fix, which you can hand straight back to your coding assistant. Start free.

Frequently asked questions

Is AI-generated code less secure than human code?

It can be, especially without review. AI tends to reproduce common insecure patterns and skip authorisation unless asked.

Can AI fix the vulnerabilities it creates?

Often, if given a precise description of the issue and fix. Verified findings with exact remediation make this effective.

Should startups avoid AI coding tools?

No. They are productive. Pair them with security requirements, review and automated testing.