The Cost of 'Vibe Coding': Productivity Gains vs. Security Debt
AI-generated image · US National Wire
As non-coders use AI to build apps through natural language, cybersecurity firms warn of a massive spike in vulnerabilities.
The rise of "vibe coding"—a term coined by OpenAI co-founder Andrej Karpathy to describe generating code via AI conversation without deep technical knowledge—is transforming how creators build software. As Engadget first reported, while this approach allows for rapid development with fewer resources, it introduces significant technical and security risks.
Reporting from Engadget highlights a stark trade-off: the cybersecurity firm Apiiro found that while vibe coding makes engineers four times more productive, it resulted in ten times the number of security issues among Fortune 50 companies. Because AI models may take shortcuts or hallucinate non-existent packages, creators risk deploying apps with critical vulnerabilities, including those identified by the OWASP Top 10, if they do not manually implement safety guardrails.
To mitigate these risks, Engadget suggests that creators use specific tools for managing sensitive data. Rather than placing API keys in prompts, users should utilize "secrets" or "environmental variables" tabs in platforms such as Replit, Lovable, or Vercel. For those pushing code to Github, tools like TruffleHog can be used to ensure sensitive information has not been leaked.
Furthermore, the lack of technical oversight can leave apps open to SQL injection and DDoS attacks. Engadget recommends that creators implement rate-limiting to protect their budgets and data, and utilize security evaluation tools such as Claude Code Security, Codex Security, SafeToShip, CheckVibe, the Vibe App Scanner, or Stackhawk's Wingman to review AI-generated output.