5 safety practices to know before vibe coding

Five essential safety practices should be observed before engaging in "vibe coding," a method of generating code via AI models without fully understanding or reviewing the code. This practice, popularized by OpenAI co-founder Andrej Karpathy, promises speed and resource efficiency but can pose significant security risks if not handled properly. According to cybersecurity firm Apiiro, while vibe coding can make engineers four times more productive, it also leads to ten times more security issues.

Firstly, treat the AI model as a lazy genie that may not implement safety measures or double-check work. Clearly specify your requirements, including privacy settings, access limitations, and other security features like encryption, to the AI. Use markdown files or knowledge sections in AI models to set persistent rules and context files.

Secondly, avoid directly inputting sensitive data such as API keys or passwords into the AI prompt. Instead, store such information securely in a password manager and utilize environmental variables or secrets tabs on platforms like Replit, Lovable, or Vercel. If necessary, create a backend .env file in a .gitignore file and exclude it from public visibility.

Thirdly, be cautious when using AI for tasks involving SQL databases. Implement techniques like parameterization, input sanitization, Server Actions, and Row-Level Security (RLS) to safeguard against SQL injection attacks. Additionally, ensure the AI uses the latest versions of libraries and packages to prevent the use of malicious or nonexistent packages.

Fourthly, protect your app from DDoS attacks by implementing rate limiting, which limits the frequency of specific actions. Rate-limit by account ID first and then by IP address to prevent easy circumvention via VPNs. Incorporate email or phone authentication and CAPTCHA to further deter unwanted activities.

Lastly, consider utilizing AI tools designed to scan and evaluate your vibe-coded projects for potential exploits. These include Claude Code Security, Codex Security, Stackhawk's Wingman, CheckVibe, SafeToShip, and the Vibe App Scanner. Regular monitoring of your vibe app or site is also crucial for maintaining long-term security.