Vibe coding security risks — the 2026 field guide

What it is

Vibe coding is a shorthand for AI-assisted application development where a non-expert founder uses tools like Lovable, Bolt, Cursor, Replit, or v0 to ship a complete product with minimal code review. The same speed that lets someone ship a SaaS in a weekend is the reason the industry's baseline security quality has regressed.

Vulnerable example

// The archetypal vibe-coded bug: no auth on a sensitive route.
// This ships in about 1 in 4 new apps we scan.
// app/api/admin/reset-user/route.ts
export async function POST(req: Request) {
  const body = await req.json();
  await db.user.update({
    where: { id: body.userId },
    data: { password_reset_required: true },
  });
  return Response.json({ ok: true });
}

Fixed example

import { auth } from "@/lib/auth";

export async function POST(req: Request) {
  const session = await auth();
  if (!session?.user?.is_admin) {
    return new Response("forbidden", { status: 403 });
  }
  const body = await req.json();
  await db.user.update({
    where: { id: body.userId },
    data: { password_reset_required: true },
  });
  return Response.json({ ok: true });
}

How Securie catches it

Securie is purpose-built for this class of bug. The intent graph infers that `/api/admin/*` is an admin boundary; the missing auth check becomes a finding. A ready-to-merge patch is posted as a pull-request comment.

Checklist

• Every admin and internal route is guarded by an authorization check
• Supabase Row-Level-Security is enabled on every multi-tenant table
• Secrets are in a secrets manager, not in the repository or client bundle
• Production has a per-key spend cap on every paid API
• Pull requests are reviewed before merge, even when the reviewer is also AI
• A security tool runs on every pull request and every deploy

FAQ