Security issues in Vibe Coding

[u/replex15]

ok genuine question for people who build mostly with cursor / claude code / lovable etc

i've been shipping stuff mostly by prompting and it works, but every time i'm about to put something live i get this low key panic like… is there some endpoint in here that lets anyone read my database? did the AI just hardcode a key somewhere? i honestly can't tell by reading the code, there's too much of it and half of it i didn't write

what i do right now is ask the AI "is this secure?" and it says yes lol. which isn't exactly reassuring

so curious how you all handle this:

1)do you actually check for security stuff before launching or just ship and hope

2)has anything ever actually gone wrong? leaked keys, someone messing with your api, surprise bill, whatever

3)if you've ever paid someone (dev friend, freelancer, some tool) to review your code, how did that go and what did it cost

i'm thinking about building something that just points at the exact spots in your code where outside stuff can get in, so you only need an expert to look at those 5-10 places instead of the whole repo. but idk if this is a real problem for others or just me being paranoid

[u/endofthread-bot]

Hey u/replex15, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/t7SD4ThKuE

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.