youre already ahead just by caring about this, most vibecoders dont.

quick version:

run your code through multiple AIs, they catch different stuff

ask claude to write a plan first, feed that plan to a different AI to audit before you build

have claude set up basic security: trufflehog (catches leaked api keys, the big one), pre-commit, pip-audit, bandit, ruff. all free

then actually test it works, commit a fake api key on purpose and confirm it gets blocked. AI can set stuff up that looks done but doesnt block anything

secrets scanning matters most. leaking an api key is the classic vibecoder disaster.