AI writes working code fast. Working is not the same as secure. Here is what structurally goes wrong in AI-built apps, and how to catch it.
Why AI code trips up here
An AI assistant optimises for one thing: it works in the preview. Security is invisible in that test — a table without permissions works perfectly, until someone reads it. So the mistakes that remain are systematically the same ones.
That is good news: a short list of checks catches the vast majority.
The recurring patterns
- Database tables without permissions, or with a policy that lets everyone in.
- Secret keys ending up in the browser bundle or in the repository.
- Roles and permissions the user can edit themselves.
- Server functions with no check on who calls them.
- Input passed unchecked into the database or an external service.
- Outdated or vulnerable packages, carried in by a suggestion from months ago.
- Error messages that hand internal details back to the visitor.
Compare these mistakes with the OWASP top 10 and review securing Supabase too.
What a one-off review doesn't solve
A single review helps for that version. But with vibe coding the code changes daily, and every new prompt can reopen a hole you closed last week. Security has to ride along with each change instead of sitting on top of it.
A workable approach
Four steps you can set up in an afternoon:
- Put a scan on your repository that runs on every push.
- Block the things that are never acceptable: leaked keys, tables without permissions.
- Let fixes arrive as a pull request, so you read them before accepting.
- Check before each deploy whether findings are still open.
Start by checking whether your app is safe before admitting real users.
Frequently asked questions
Is vibe coding insecure?
Not inherently. The code AI writes is often fine; what's missing is everything you can't see in a preview — permissions, key handling, input validation. You have to organise that layer deliberately.
Can I just ask the AI to secure its own code?
Partly. Asking for tighter permissions or input checks helps, but the same assistant misses the same things again. A check outside the conversation is more reliable.
Do I need a pentest?
A pentest is valuable for an app that is live and handling real data. For a project that still changes daily, continuous scanning is more practical and cheaper; a pentest comes after.
What other tools are there?
There is a whole market of application security scanners, from broad platforms to specialist tools. VibeShield focuses specifically on apps built with AI tools and the mistakes typical to them.