What is vibe coding?
Vibe coding means building software by describing what you want to an AI tool in plain language and accepting what it writes, often without reading every line. It makes building much faster and open to more people. The catch is that the AI builds what you ask for, and security is rarely something people ask for.
ON THIS PAGE
What it means
Instead of writing code, you write prompts. Tools such as Lovable, Bolt, Cursor and Claude Code turn them into working apps.
The code works, so it feels finished. But 'works' and 'safe' are different things, and the gap is where most problems in vibe-coded apps live.
Why it matters for vibe-coded apps
You can ship a real product in a weekend without ever seeing the parts that keep it safe.
- Secrets, open databases and missing login checks are common in generated code.
- No one reviews the code, so mistakes go live unnoticed.
- Real user data can be exposed before you have a single paying customer.
Example
Asking an AI tool for a feature.
Add a page where users can upload and view their invoices.Add a page where users can upload and view their invoices.
Only the signed-in owner may see their own invoices.
Store files in a private bucket and use short-lived links.
Keep all keys in server-side environment variables.Telling the AI the security rules up front costs one extra line and prevents most common mistakes.
How to check if your app has this problem
- 1Run a free check on your live site to see what an outsider can see.
- 2Ask your AI tool to explain how login, data access and secret keys work in your app.
- 3Read the file list the AI changed before you publish.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Add security requirements to your prompts: who can see what, and where secrets live.
- 2Run a check after every big feature, not only before launch.
- 3Use fix prompts from your report to have your AI tool close each gap.
- 4Keep your code in GitHub so you can review changes and roll them back.
Review my project for common security mistakes in AI-generated apps: exposed secret keys, database tables without access rules, routes that don't check who is calling, wide-open CORS, and missing security headers. List each problem with the file it is in and a proposed fix. Don't change anything yet.
Check if your app has this problem
Paste your website and we'll check for vibe coding issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- API key exposureA secret key for a paid service ends up where the public can see it.
- Row level securityA database setting that decides which rows each user can see or change.
- Hallucinated packagesAdd-ons an AI suggests that don't exist, or that attackers have since created.
- Prompt injectionHidden instructions that trick an AI feature into ignoring your rules.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.