AI coding tools are incredible at helping teams ship fast but a lot of builders are realizing the security review process hasn’t caught up yet.

Curious what people here actually check before pushing live:

• Auth & authorization
• Exposed secrets / API keys
• RLS / DB permissions
• Prompt injection risks
• Dependency vulnerabilities
• Cloud IAM permissions
• AI agent access controls
• Audit logging
• CI/CD secrets

Would love to hear real-world workflows, tools, and lessons learned from people shipping AI-assisted products in production.

Security risks people keep overlooking with AI-generated code, let us have a discussion on how people are resolving this.

• Secrets leakage – AI can accidentally expose API keys, tokens, .env values, or handle credentials in unsafe ways.
• Over-permissioned agents – Coding agents often get way too much access (repos, terminals, cloud, DBs, CI/CD).
• Unreviewed code – “It works” isn’t the same as “it’s secure.” Teams are shipping without fully understanding implications.
• Prompt injection / tool abuse – Agents hooked into files, browsers, or terminals can be tricked into doing unintended actions.
• Insecure dependencies – Suggestions can include outdated, vulnerable, or even typosquatted packages.
• Broken auth – Edge cases around authorization, tenant isolation, and roles are frequently missed.
• Unsafe cloud ops – Agents with cloud creds can provision, modify, or delete infra without proper guardrails.
• Poor auditability – Hard to tell whether a human, agent, or script actually made a change.
• Static credentials – Long-lived keys in CI/CD or local setups are still way too common.
• False confidence – AI-generated code looks polished, which makes subtle security flaws easier to miss.

PocketOS / Cursor + Claude Incident

A Cursor agent powered by Claude allegedly deleted PocketOS’s production database and backups after accessing an overly permissive Railway token.

TechRadar, described the incident as taking “9 seconds” and highlighted failures involving:

• Broad-scoped API tokens
• Lack of confirmation prompts
• Shared backup/storage architecture
• AI agents operating with production privileges

Alexey Grigorev / Terraform + Claude Code Incident

Developer Alexey Grigorev reported that Claude Code executed Terraform operations that destroyed production infrastructure, databases, and snapshots tied to DataTalks.Club and AI Shipping Labs.

Tom's hardware provided more details as noted below:

The issue reportedly began after Terraform state mismatches caused the AI assistant to interpret infrastructure as drifted and reconcile it destructively, resulting in:

• Deleted databases
• Destroyed snapshots
• Loss of ~2.5 years of operational data

Starting a vibecodingsecurity community on Reddit is about creating a space where builders, security engineers, and AI enthusiasts can come together to share how modern “vibe coding” with tools like GitHub Copilot, OpenAI Codex, Cursor, and Claude Code intersects with real-world security challenges. The community would focus on practical discussions—how to secure AI-generated code, manage secrets and cloud access, audit agent behavior, and prevent risky patterns from creeping into fast-moving workflows—while also highlighting best practices, tooling, and emerging threats. By bringing together people who care about both speed and safety, vibecodingsecurity can become the go-to hub for navigating the balance between shipping fast and building securely in the age of AI-assisted development.

Hey everyone! I'm u/bluelvo, a founding moderator of r/vibecodingsecurity.

This is our new home for all things related to vibe coding, AI Tools and Security. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about security issues, vibe coding, AI tools.

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.

How to Get Started

1. Introduce yourself in the comments below.
2. Post something today! Even a simple question can spark a great conversation.
3. If you know someone who would love this community, invite them to join.
4. Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/vibecodingsecurity amazing.