Skip to content
FGFawaz GomaaWeb Developer
Back to the journal
Security

Vibe coding security risks: why unreviewed AI code fails enterprise audits

Generating an app by prompting is fast and fun. Shipping it without review is how secrets leak, permissions break and audits fail.

Written by Fawaz Gomaa7 min read
Vibe coding security risks: why unreviewed AI code fails enterprise audits06Security
01

Speed without a second look

'Vibe coding' describes building software by describing what you want and accepting whatever the AI produces, as long as it seems to work. For prototypes it is a superpower. For systems that hold customer data, 'seems to work' is not a standard.

02

What audits typically find

Generated code tends to optimise for the visible result, not for the invisible rules.

  • API keys and secrets placed in front-end code.
  • Authorization checked in the browser instead of the server.
  • Missing input validation and rate limits.
  • Outdated or unnecessary dependencies.
authorization.ts
// Risky: the browser decides who is admin
if (localStorage.getItem("role") === "admin") showAdminPanel();

// Safer: the server verifies every request
const user = await requireAuth(request);
if (!(await hasRole(user.id, "admin"))) return forbidden();
03

Keep the speed, add the review

The answer is not to stop using AI. It is to treat its output like a pull request from a fast junior developer: read it, test it, run a security scan and make sure a human understands every part that touches data or money.

“AI can write the code. Someone still has to own it.”
AISecurityCode review

Continue reading