Why this matters

By 2026, more than 40% of new web apps at small businesses have at least one component generated by an AI tool. AI-assisted code is now mainstream. The security industry hasn't caught up. Most vibe coding platforms run zero security scanning on their output before they hand you a deploy URL.

This article isn't an argument against vibe coding. We use it. We sell it. It's an honest catalogue of the 12 risks that actually show up in production AI-generated code — and how to mitigate each one.

The 12 risks (in order of frequency)

RISK #1

Hardcoded API keys and secrets

The single most common issue. AI tools cheerfully embed Stripe keys, OpenAI keys, database passwords, and JWT secrets directly into source files. When the user copies the code into a public repo (or the vendor stores it on shared infrastructure), the keys are exposed.

Mitigation: Run secret scanning on every AI output (Gitleaks, TruffleHog, or the platform's built-in scanner). Block deploy if secrets are found. Force secret references through a vault (HashiCorp, AWS Secrets Manager, or platform-native).
RISK #2

SQL injection via string concatenation

AI-generated database code often interpolates user input directly into SQL strings. query = `SELECT * FROM users WHERE email = '${userEmail}'` is a textbook injection vector. The AI knows about prepared statements — it just doesn't always use them.

Mitigation: SAST scanning that flags string-interpolated SQL. Prompt-level enforcement that requires parameterized queries. ORM-first templates (Prisma, Drizzle, SQLAlchemy) so injection is structurally impossible.
RISK #3

Missing authentication on API endpoints

The AI builds the CRUD endpoints. It forgets to require auth. Result: anyone can curl /api/users/123 and read user 123's data. This is the #1 cause of "we got owned over the weekend" stories from vibe-coded startups.

Mitigation: Auth-by-default scaffolding (every route requires a session unless explicitly marked public). Endpoint-level enumeration tests post-deploy. Static analysis that flags routes without an auth check.
RISK #4

Hallucinated / slopsquatted dependencies

AI generates code that imports a package that doesn't exist. Attackers monitor public AI outputs, identify these hallucinations, and register the missing package on npm/PyPI with malicious code. When the developer runs install, the supply-chain attack is delivered. This is called "slopsquatting."

Mitigation: Software composition analysis (SCA) that validates every imported package exists on the official registry, has >90 day history, and has reasonable download counts. Block install if any condition fails.
RISK #5

Cross-site scripting (XSS) from unescaped input

AI builds a comment system. Comments render via innerHTML instead of textContent. Attacker submits <script>alert(document.cookie)</script>. Game over.

Mitigation: Framework-level XSS protection (React's auto-escaping, Vue's text directives). SAST rules that flag direct innerHTML usage. CSP headers on every page.
RISK #6

Insecure direct object references (IDOR)

The AI builds /api/invoices/:id. It checks "is the user logged in?" but not "does this invoice belong to this user?" Attacker logs in as user A, changes the ID, reads user B's invoice. Classic IDOR.

Mitigation: Authorization layer that enforces resource-owner checks at the data access layer (row-level security in Postgres, RLS policies in Supabase). Linter rules that require owner-scoped queries.
RISK #7

Outdated dependencies with known CVEs

AI training data has a cutoff. It often pulls package versions from 2023 or earlier — versions with documented CVEs. The app ships with vulnerable libraries in production.

Mitigation: Dependabot or Renovate on every commit. SCA scan that blocks deploy if any dependency has a CVSS >7 vulnerability. Pin minimum versions in prompt templates.
RISK #8

CORS misconfigurations

AI sees CORS errors during testing and defaults to Access-Control-Allow-Origin: *. This works for development. In production, it means any website can call your API on behalf of a logged-in user.

Mitigation: Environment-aware CORS templates that restrict origins to known frontends. Linter rules that block wildcard CORS in production builds.
RISK #9

No rate limiting on auth endpoints

AI-generated login routes rarely include rate limiting. Result: credential-stuffing and brute-force attacks succeed because there's nothing slowing them down.

Mitigation: Edge rate limiting (Cloudflare, Vercel, AWS WAF) applied to all auth routes. Exponential backoff on failed login attempts at the application layer.
RISK #10

Verbose error messages leaking internals

AI codes try/catch blocks that send the full stack trace to the user on error. The stack trace includes file paths, framework versions, database schema, sometimes connection strings. Attackers love these.

Mitigation: Production-mode error handling templates that return a generic message to the user and log details server-side. Environment checks in error formatters.
RISK #11

Data residency violations

Most consumer vibe coding tools run on US-based shared cloud. If your app handles EU citizen data, you may be in GDPR violation the moment the AI deploys it. HIPAA-covered data has similar issues. None of this is visible until your compliance team finds out.

Mitigation: Deploy AI-generated apps to your own cloud (AWS, Azure, GCP) with region pinned to your compliance zone. BYO LLM with regional model endpoints. Avoid platforms that own the deploy infrastructure.
RISK #12

No audit trail

The AI built the app. Six months later, an auditor asks "who changed line 47 of api/users.ts and when?" There's no answer — no Git history, no deploy log, no diff trail. Failing the audit isn't optional in regulated industries.

Mitigation: Every AI-generated change goes through a real Git commit with attribution. Deploy logs retain 7+ years. Audit trail covers every prompt, every diff, every approver.
ENTERPRISE-GRADE

All 12 risks mitigated by default

Clarista runs every line of AI-generated code through automated scanning before it sees production. SAST, SCA, secrets, hallucinated packages, IDOR, missing auth — all caught at build time. Your CISO signs off because the controls are real.

See Enterprise Vibe Coding →

Why consumer vibe coding tools can't fix this

The risk profile is structural, not a tooling gap that Lovable or Bolt will close next quarter. Consumer tools have a different customer: indie founders who optimize for speed over compliance. Their UX is built around "ship in 5 minutes," not "pass a SOC 2 audit." Adding security gates would slow them down and reduce conversion. They won't do it.

Enterprise vibe coding platforms invert the priority. Slow first run by 30 seconds to scan for vulnerabilities? Worth it. Block deploy if a dependency has a CVE? Required. The customer pays for the guardrails.

What "secure AI development" actually looks like

The bar for enterprise-grade AI development as of 2026:

The bottom line

Vibe coding is real, useful, and here to stay. The security gaps are also real. The fix isn't to stop vibe coding — it's to run AI-generated code through a platform that scans it the way you'd scan human-written code, before it touches production.

That platform is what enterprise vibe coding looks like in 2026.

"Is vibe coding bad?" — and the full list of vibe coding security risks, vulnerabilities, and limitations

People ask "is vibe coding bad" — the honest answer is: vibe coding is a tool, and like any tool it has clear vibe coding security risks, vibe coding security vulnerabilities, and vibe coding limitations. The 12 risks documented above are the most common. The limitations beyond security: hallucinated dependencies, architectural drift, code that works but no human understands, and the production gap (consumer tools are designed for prototypes, not regulated production). None of this means vibe coding is bad — it means you need governance, scanning, and the production layer enterprise vibe coding platforms provide.

FAQ

Is AI-generated code more vulnerable than human-written code?

Not categorically — but it has different failure modes (hallucinated dependencies, hardcoded secrets, missing auth). Without scanning, the vulnerability rate is higher. With scanning, comparable or lower than the average human-written codebase.

Can I use Lovable or Bolt for HIPAA-covered apps?

No. Neither offers a BAA, both run on shared infrastructure, neither provides the audit logs HIPAA requires. For HIPAA, use a platform with a signed BAA — like Clarista.

What is slopsquatting?

An attack where bad actors register fake packages on npm/PyPI to match the names that LLMs hallucinate in generated code. When a developer runs install, the malicious package is delivered. Unique to AI-generated code.

How does Clarista compare to running my own SAST/SCA pipeline?

Same idea — but built-in, applied to AI output specifically, and integrated into the vibe coding flow. You can run external scanners too, but most enterprises prefer the integrated workflow so AI-generated code can't slip past the gate.