Five Safety Practices for Vibe Coding, According to Security Experts

Vibe coding has spread across the tech world since early last year, after OpenAI co-founder Andrej Karpathy described generating code by simply talking to an AI model without really thinking about the code itself. "I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works," he wrote in the X post that sparked the term.

It is now the new normal in the industry. But generating code with AI that you don't fully understand or haven't reviewed can pose serious security risks to yourself, your devices and anyone using your app. Cybersecurity firm Apiiro says it looked into Fortune 50 companies and found that vibe coding makes engineers four times more productive but resulted in ten times the number of security issues.

Be specific in the prompt and make a markdown file. Many AI models take shortcuts to technically deliver what you asked for without implementing safety measures. Spell out privacy specs, access limits and protections like encryption, and create a persistent .md file so the AI considers your safety guidelines with every task.

Keep API keys and passwords out of the chat and code. Store sensitive data in a dedicated password manager or the "secrets" tabs on Replit, Lovable or Vercel, and check your code with TruffleHog to make sure nothing leaked.

Protect app data by telling the AI to parameterize queries, sanitize inputs, enable row-level security and use the latest library versions. Rate limiting is your friend: it can prevent brute-force and DDoS attacks, and on free apps it can cap token use per user per day.

Finally, review and test the AI's work. Ask the AI to evaluate its own code against the OWASP Top 10, bring in other models to look for issues, and keep monitoring your app after you ship.