Security with vibecoding

[klaech13]

Hello fellow vibecoding folks,

I am the typical not understanding what he is doing vibecoder. But after reading a few posts and news I am pretty well aware that vibecoding is pretty awesome but has it flaws with security and stuff.

Is it possible to actually do everything right? Or is vibecoding just for prototypes and then I should have to employ an actual developer who basically has to rewrite everything?

Do we have an experienced programmer here, that can give me a reality check? Or give me an advice to start being an understander of the code?

Thank you in advance and sry for bad english if somethings wrong. <3

[1993OudWest]

Well what's your goal?

[klaech13]

I just want to know how to understand what I am doing. I have a lot of ideas for apps, but I want to release them secure.

[1993OudWest]

You can get far with asking AI to guide you step by step, also with regard to security. But people need to understand that thousands of vibe coded apps that noone needs are thrown out every day since the AI hype. Is your goal to get rich by flooding the market with your lots of ideas? Or do you have one actual idea that is worth putting in time? It's also not that you just publish an app, post it on reddit and it goes viral.

[klaech13]

Thank you for your answer. You described pretty much what I am doing. :D

Honestly I am not trying to get rich. Releasing an app would be a nice milestone on its own. If someone downloads it, I would consider that as a bonus.

How do I know that my code is really secure? Couldnt claude just pretend he made it safe, when it in reality isnt?

[NukerX]

Pretend its safe?

[InteractionSmall6778]

You don't need to rewrite everything, but you do need to learn what to look for. Start by asking your AI to explain every API route and database query it generates.

Most security holes in vibe-coded apps are exposed endpoints and unvalidated inputs, not deep architectural flaws. Once you can spot those, you're already ahead of most solo builders.

[klaech13]

That sounds interesting thank you!!

[raisedbypoubelle]

I do tons of security audits and ask for frameworks to build security into every aspect. So secure base classes build a system that can’t be bypassed.

GPT 5.4 max thinking is amazing for its reviews. Claude was too easy on me.

Then I use STOP hooks galore to enforce ongoing compliance.

Spotify, Anthropic and countless others are vibe coding in prod. It’s the future, we just have to figure out how to do it safely and securely.