Vibe Coding Security
The big picture: why AI builders optimize for “it works” over “it’s secure,” what the research and the breaches show, and the checklist to ship without leaving the door open.
14 articles
Vibe Coding Security: The Complete Guide
Vibe coding security, explained for non-developers. Why AI-built apps ship with leaks, the main risk classes, and how to check your own app in minutes.
How to Check If a Website Is Safe: The 2026 Checklist
Learn how to check if a website is safe: HTTPS, domain age, reviews, and blocklists in minutes, then the deeper checks a padlock alone cannot show you.
OWASP Top 10 for Vibe-Coded Apps (Plain English)
The OWASP Top 10 explained in plain English and mapped to what AI coding tools actually get wrong, so you know exactly what to check on your app first.
URL Checker: What Scanning a Link Really Tells You
A url checker scans a link for phishing, malware, and a valid certificate. Here is exactly what it checks, and why that says nothing about your own app.
Is My Vibe-Coded App Safe to Ship? The 10-Minute Check
Is your vibe-coded app safe to ship? Answer 5 yes/no questions in your browser to find out, no code reading required. Get a clear verdict in 10 minutes.
How We Taught Our Scanner to Detect IDOR
Our scanner missed one flaw: a broken-access-control IDOR. Here's how we taught its AI agent to detect IDOR on every run, without crying wolf on public keys.
We Built a Broken Vibe-Coded App to Test Our Scanner
We built a deliberately-broken vibe-coded app with 21 planted flaws to test our security scanner. It caught 19 of 20 — here's the one it missed, and why.
Are Vibe-Coded Apps Secure? We Scanned 61 to Find Out
Are vibe-coded apps secure? We scanned 61 live apps from Lovable, Bolt, v0, Replit, Cursor and Base44 — zero leaked a real key, but most flunk the basics.
45% of AI-Generated Code Ships With a Vulnerability: The Research
AI generated code security, by the numbers. Four studies — Veracode, Carnegie Mellon, Escape.tech, Tenzai — on how often AI code ships with a vulnerability.
DAST vs SAST for AI-Generated Apps (and Why Deployed-App Scanning Wins)
DAST vs SAST for AI-built apps: a security scanner for AI code should test the deployed app, not just read source. Here's why deployed-app scanning catches more.
Is Your Vibe-Coded App Leaking Data? The 7 Gaps in Every AI-Built App
Worried your vibe-coded app is leaking data? Here are the 7 security gaps that show up in nearly every AI-built app — and how to check each one yourself.
The Pre-Launch Security Checklist for Vibe-Coded Apps
A vibe coding security checklist for non-developers: the database, secrets, storage, auth, and header checks to run before you ship your AI-built app. Print and go.
The Vibe-Coding Breach Timeline: Enrichlead, Tea, Base44, Moltbook
A timeline of the biggest vibe coding breaches — Enrichlead, Tea, Base44, Moltbook. What happened, the real root cause, and the lesson behind each AI app breach.
Why AI Optimizes for 'It Works,' Not 'It's Secure'
Why is AI code insecure? Because models optimize for code that runs and demos well, not code that's safe. The mechanism behind AI code security problems, explained.