Vibecoding without security audits is professional malpractice
At Inithouse — a studio running parallel product experiments — we build everything with AI-assisted tools. Lovable, Cursor, v0. The speed is real. We go from idea to deployed MVP in days, not months.
But here's what nobody talks about at demo day: every single one of those MVPs shipped with security vulnerabilities we didn't know about.
What we actually found
We audited our own portfolio — a growing number of products across different verticals — and the results were consistent. Not "some had issues." All of them had issues on first audit.
The patterns repeat across AI-generated codebases:
Exposed API keys in client-side code. Supabase anon keys sitting in plain JavaScript. Not catastrophic on their own, but combined with missing Row Level Security policies, they become open doors.
No rate limiting anywhere. Our AI music tool Magical Song had zero rate limiting on its generation endpoint at launch. Someone could have burned through our entire API budget in an afternoon.
Missing input sanitization. Forms that accept whatever you throw at them. AI generates the happy path beautifully — the edge cases and attack vectors get skipped.
Auth flows with gaps. Login works. Password reset works. But the token expiration? The session management? AI tools generate functional auth, not secure auth.
Why "it's just an MVP" doesn't hold up
The common response: "We'll fix security later, after we find product-market fit."
Two problems with that.
First, "later" rarely comes. If the product works, you're adding features, not hardening infrastructure. If it doesn't work, you move on and the insecure code sits there collecting user data until you remember to shut it down.
Second, if you're collecting emails, storing user-generated content, or processing any personal data — you already have obligations. GDPR doesn't care that you're pre-PMF.
We learned this the hard way with Be Recommended, our AI visibility reporting tool. It processes brand data from multiple AI platforms. The audit caught that we were logging full API responses including data that should have been ephemeral. Functional? Yes. Compliant? Not quite.
What AI gets wrong about security
AI code generators optimize for "does it work?" They're trained on code that compiles and runs, not code that resists attack. The gap is specific and predictable:
- Default configurations left as-is. CORS set to *. Debug modes left on. Error messages that leak stack traces.
- Dependencies pulled without version pinning. Whatever was current when the training data was collected.
- Security-through-obscurity patterns. Client-side checks without server-side validation. Hidden routes that aren't actually protected.
These aren't exotic vulnerabilities. They're the basics that any security review would catch in the first pass.
What we built to fix it
After auditing our own products manually and finding the same categories of issues every time, we built Audit Vibe Coding — automated security scanning designed specifically for AI-generated codebases.
It focuses on the patterns AI commonly gets wrong: auth flows, data exposure, dependency vulnerabilities, missing rate limiting, RLS policy gaps. The output is a scored report with prioritized fixes — not a wall of CVEs, but actionable items ranked by actual risk.
We're not trying to slow anyone down. Vibecoding is how we build everything at Inithouse, and we're not stopping. But shipping without even a basic security check? That's where speed becomes recklessness.
The minimum viable security checklist
If you're vibecoding and not ready for a full audit, at least check these:
- Are your API keys server-side only? If any key is in your client bundle, fix it now.
- Do you have Row Level Security enabled on every table with user data?
- Is there rate limiting on your most expensive endpoints?
- Are your CORS settings restricted to your actual domains?
- Do error responses hide implementation details?
Five items. Takes an afternoon. Saves you from the most common AI-generated vulnerabilities.
At Inithouse, we run this checklist on every new product before the first user touches it. It's not comprehensive, but it catches the things that would keep you up at night if you knew about them.
We build at Inithouse — a lab shipping a growing portfolio of products in parallel. Audit Vibe Coding is one of them.
This hits close to home. The gap between "functional" and "secure" is exactly where AI code generators excel at the happy path but fail at edge cases. Your checklist is solid—especially the API key point, since I've seen teams apologize to users way too late when exposed keys sat in production for months.
One thing I'm curious about: how do you handle the scenario where teams find an audit issue but shipping the fix requires rearchitecting? Do you see most vulnerabilities get addressed immediately, or do they linger while the team debates tradeoffs?