Vibecoding · Module 05 of 7

Security

The part AI gets wrong by default — secrets, auth, database rules, and input validation — fixed with a checklist you can follow.

1 lesson5 exercises
Topics & techniques

Security essentials

The handful of security things that go wrong in AI-built apps, and how to ask for them done right.

5 cards →
Knowledge card
Add Authentication and Authorization Early
Two related but distinct protections every multi-user app needs: authentication (proving who a user is — login) and authorization (deciding what that user is allowed to do and see). AI-built apps often get a login screen but skip real authorization, so once you're logged in you can reach data that isn't yours.
L3 · Workflows
Mistake
Don't Ship the AI's Insecure Defaults
The quiet class of security holes that come not from missing code but from settings the AI leaves in a convenient-for-development, dangerous-for-production state: debug mode on, verbose error messages that leak internals, wide-open cross-origin (CORS) rules, default admin credentials, and permissive file or bucket permissions.
L2 · Context engineering
Mistake
Never Put Secrets in the Frontend
The single most common security mistake in AI-built apps: a secret — an API key, a database password, a payment or email provider token — ends up in code that runs in the user's browser, where anyone can read it by opening developer tools. AI does this constantly because the quickest way to make a feature work is to put the key right where it's used.
L2 · Context engineering
Best practice
Validate Every Input and Lock Down Your Database
Two defences that guard your data: validating every input the app receives (never trusting what comes from the browser), and configuring database access rules so each user can only read and write their own data. AI frequently ships apps that trust all input and leave the database open, which is how one crafted request dumps or corrupts everything.
L3 · Workflows
Best practice
The Vibecoder's Security Checklist
The short, non-negotiable list of security things to get right in any app you build by vibecoding. It exists because AI reliably produces code that works in a demo and is wide open in production, and none of these gaps show up when you test your own app — only when someone malicious does.
L3 · Workflows
Test yourself

Is your vibe coded app actually secure?

Six questions on the part AI gets wrong by default — secrets, auth, database rules, and input validation. This is the quiz worth taking before you ship. No sign-up, instant score, and you can share how you did.

  1. Q1 What's the single most common security mistake in AI-built apps?
  2. Q2 You've added a login screen. Is the app secure?
  3. Q3 Your app validates input in the browser. What's missing?
  4. Q4 Why is pasting user input into a query string dangerous?
  5. Q5 Your app works in development. What's the risk in deploying that exact config?
  6. Q6 'It works when I use it.' What does that prove about security?
0 / 6 answered