Vibe-Coded Apps Can Introduce Hardcoded Secrets, Broken Access Controls, and Input-Validation Flaws

Summary

An explainer warns that AI-generated apps may contain hardcoded secrets, missing authorization, and poor input validation, and recommends using secrets managers, checking access rights, and validating inputs server-side.

Key points

• The author cautions that AI-generated code may work without being secure, especially when developers trust code they have not reviewed or understood.
• Hardcoded API keys, passwords, or tokens can expose secrets; store them in environment variables or a secrets manager.
• Apps may authenticate users but fail to verify their authorization to access specific records, enabling IDOR-style data access.
• Insufficient input validation can expose applications to SQL injection, cross-site scripting, or path traversal.
• The article recommends checking access rights for every endpoint, validating input on the server, and using parameterized queries.
• The author says the examples reflect personal experience, not a comprehensive study, and advises reviewing AI-generated code before deploying it.