5 safety practices to know before vibe coding

Here’s what beginners need to know to vibe code securely.

Skynesher/Getty Images

The term "vibe coding" has spread across the tech world since early last year, after OpenAI co-founder Andrej Karpathy wrote about his experience of generating code by just talking to an AI model without really thinking about the code itself. "I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works," he wrote in the X post that sparked the term.

In the tech industry, vibe coding is now the new normal. While it's a powerful way to move faster with less resources, generating code with AI that you don't fully understand or haven't reviewed can pose serious security risks to yourself, your devices and anyone using your app. The AI app-focused cybersecurity firm Apiiro says it looked into Fortune 50 companies and found that vibe coding makes engineers four times more productive but resulted in ten times the number of security issues. So don't vibe-code without following these basic security best practices.

1. Be specific in the prompt and make a markdown file

Treat the AI model like you would a lazy genie. Many AI models will take quick shortcuts to technically deliver what you asked for but without implementing safety measures or double-checking work. Don't assume the AI will keep critical information private, implement cybersecurity best practices or check its code for potential exploits.

Spell out what you want with as much specificity as possible, including privacy specs, limitations on who can access what part of what you're creating and other security guardrails and protections you want added to the project, like encryption. You can also ask it to reference the OWASP list of top vulnerabilities to help avoid these issues before the code has even been written.

Most AI models will give you the ability to make persistent rules or context files, so you don't have to repeat the same instructions every time you sit down to build. Create a markdown file (.md file) with any AI model or add information to the "Knowledge" section in the Lovable agent or the "Memory" section if you're using Replit. AI markdown files are useful for adding safety guidelines because the AI will consider the file's instructions with every prompt or task. And before getting started, choosing vibe-coding tools that support audit logs can help you track every change to your project more easily.

2. Keep API keys and passwords out of the chat (and code)

It's never a good idea to put API keys or passwords directly into an AI prompt. This type of sensitive data should never show up in the code, either, because if you push your code to Github later, all that critical info will be available for anyone to see. Limiting what your AI tool has access to can also help prevent prompt injection attacks.

Instead, store sensitive data in a dedicated password manager and use the "environmental variables" or "secrets" tabs on Replit, Lovable or Vercel. This is the easiest and best method for total beginners.

If the AI tool you're using doesn't have a feature like this built-in already, you will have to make a backend "environmental variable" .env file for this data and make sure that file does not get made public at any stage in the process. This means making it part of a .gitignore file and ensuring it is never visible on the app or website's frontend.

To check if you've done this correctly, you can use TruffleHog, a tool that will check your code to make sure you haven't accidentally leaked sensitive info.

3. Protect the app data

DenPhotos/Shutterstock

If you're building anything that will involve lots of data, it may involve the use of a type of Structured Query Language, or SQL, to handle this information. Consumer apps like Spotify, for example, use SQL to optimize app performance when transmitting data to the user. Vulnerable SQL databases can lead to SQL injection attacks, allowing hackers to swipe or delete that data and replace it with whatever they want. 

Tell the AI to parameterize queries, sanitize inputs, use Server Actions for critical actions, enable row-level security (RLS) and create RLS policies if applicable. All of these tactics make code harder to exploit and protect your app data.

It's also good practice to make sure the AI is using the latest versions of existing libraries. AI has also hallucinated the existence of packages that aren't real or might use malicious ones by accident, so keep an eye out for this as well. 

4. Rate limiting is your friend

If you've ever heard about DDoS attacks, rate limiting is one way to help protect your app from falling victim to one. Rate limiting can prevent them by limiting how many times someone (or a bot) can do a specific action.

Password attempt rate-limiting can prevent brute-force attacks and credential-stuffing. How much you'll want to rate-limit depends on what your vibe app does. If it's a free app like a support chatbot, rate-limiting could save your bank account by limiting how many tokens can be used per day per user. If possible, rate-limit by account ID first and then by IP address. This way, hackers can't spam as easily and your rate-limiting can't be circumvented with VPN use.

Email or phone authentication flows and CAPTCHA are other good steps to add to your app to help prevent unwanted activity.

5. Review and test the AI's work

If you can't get a professional software engineer to review your vibe-coded project, ask the AI to evaluate its own work for potential exploits, including testing it against the OWASP Top 10 risks even if you had it look at these earlier. Then, use other AI models to look for potential issues.

There are also a number of tools that can evaluate vibe-coded projects including Claude Code Security, Codex Security, Stackhawk's Wingman, CheckVibe, SafeToShip and the Vibe App Scanner. But quashing bugs doesn't stop after you ship, so you'll have to monitor your vibe app or site for issues to stay safe.