Application Security — Risks in AI-Generated (“Vibe Coded”) Applications

Mamí Christina is stirring the arroz with one hand and holding her nephew Reinaldo's laptop with the other, and mija, the screen is doing things that should not be legal in the state of Florida.

"Reinaldo," she says, not even looking up. "Ven acá. Sit. What is this app you built in one weekend with your — your robot friend?"

He says it's called "vibe coding." He typed a sentence into the AI and it wrote him a whole login page. Mamí Christina puts down the wooden spoon. This is a five-alarm situation, and not because the rice is burning — although it is, someone turn that off.

Here's what nobody tells you about vibe coding, niño: the AI writes code that runs. It does not write code that survives. There's a difference, and that difference is the whole reason people like me still have a job checking behind these apps like I check behind the ears of a child who "already washed."

First problem — input validation, or should I say, the total absence of it. The AI hands you a form, the form takes whatever the user types, and it just… believes them. No sanitization, no parameterized queries, nothing. You type your name into a field and somewhere a database is quietly getting a SQL injection like it's a stranger accepting candy in a van. Every input is a stranger until proven otherwise. Write that on your forehead if you have to.

Second — authentication, and ay Dios mío, don't get me started. These vibe-coded apps love a hardcoded password sitting right there in the source code, or a session token that never expires, or — my personal favorite — "authentication" that's really just checking if a cookie exists, not whether it's valid. No MFA. No rate limiting on login attempts. You could brute-force your way in with a toddler's patience.

Third — exposed secrets. The API key. The database connection string. The AWS credentials. All committed straight into the public GitHub repo like a love letter nobody asked for. I have seen — with these eyes — a .env file sitting in a public repo with a Stripe key just waiting there like the good china displayed on the top shelf where everybody can see it but abuela said don't touch. Except nobody said don't touch, because nobody reviewed it before it shipped.

And fourth, the one people forget — third-party dependencies. The AI pulls in packages it's never met. Fifteen npm libraries deep, half of them abandoned, one of them typosquatted to look like something real but it's actually — it's actually a whole supply chain problem, that's what it is, I got ahead of myself, let me sit back down. Point is: you inherit every vulnerability in every package the AI decided to trust on your behalf, and you didn't even get a vote.

So no — the pressure cooker on my stove has a release valve. Your vibe-coded app does not. It just builds and builds — unvalidated input, secrets sitting out, dependencies nobody vetted — until one day it goes off in production and takes the kitchen with it.

You don't skip the code review just because the AI sounded confident. Confidence is not a security control, and neither is charm — believe me, I married a man with plenty of both.