App security

Vibe-coded apps ship with real security debt

AI-assisted builds still need boring checks. Headers, cookies, exposed files and auth boundaries do not become optional because the first version worked.

1 August 2026 · 5 min read

Vibe coding is brilliant at compressing the distance between an idea and a working interface. That is the thrill. A prompt becomes a route, a database table, a checkout flow, a dashboard. The trap is that a working interface can look finished long before the deployment is actually safe.

What security debt actually looks like in an AI-built app

Most early security issues in AI-built apps are not cinematic. They are ordinary omissions: no Content Security Policy, permissive CORS, weak cookie flags, missing security headers, public storage buckets, leaked environment files, or a server action trusting input it should verify.

None of those mistakes announce themselves in the demo. The page renders, the button works, the deploy succeeds. Every one of them is visible from outside the app, which is the important part: if you can measure it, so can anyone else.

Why generated code skips the boring parts

A coding agent optimises for the thing you asked for, and you asked for a feature. Nobody prompts for a referrer policy. The model has no way to know whether your app serves authenticated data or a brochure, so it produces the code that satisfies the visible requirement and stops.

This is not an argument against AI coding tools. It is an argument for a second pass that asks a different question: not does it work, but what does it expose. See why AI-built sites forget security headers for the mechanics of the most common category.

How to pay the debt down without stopping

Make security inspection part of the shipping loop rather than a project you schedule. After the app works, run the same external checks a stranger could run. Ask what the browser receives, what crawlers can read, which headers are absent, and which URLs respond when they should not.

Fix in order of blast radius rather than in the order the report lists them. A leaked key beats a missing referrer policy every time, and a scanner that ranks findings for you is doing most of the triage work already.

The useful mental model is simple: your app is not what is in your editor. Your app is what your production URL returns to the public internet. Vibe-coded or hand-written, that surface needs to be measured before people see it.

Common questions

Is vibe coding less secure than writing code by hand?

Not inherently. The difference is pace and attention. AI-assisted development produces working software faster than the surrounding production hygiene tends to keep up with, so the gap between what works and what is safe opens wider. The mistakes themselves are the same ones hand-written projects have always made.

What should I check before launching an AI-built app?

Security headers, cookie flags, CORS policy, TLS configuration, accidentally public files such as .env or source maps, and whether the site is indexable when it should be. All of those are visible from outside the app and can be checked in seconds without touching your code.

Do I need a penetration test?

Eventually, if you handle sensitive data. But an external scan catches the common public mistakes first, and it is a poor use of a pentest budget to pay someone to tell you a security header is missing.