Security for Vibe Coders

Security is the part of vibe coding that bites quietly. A broken feature shows up immediately — the button doesn't work, you fix it. A security hole shows up never, until the day someone finds it and dumps your users' data on a forum. By then the AI that wrote the bug is long gone, and you're the one explaining to a thousand people why their password leaked.

This chapter isn't about fear. You don't need to become a penetration tester or memorize the OWASP Top 10 to ship a safe small app. You need to understand a handful of ways software gets broken into, recognize the patterns the AI keeps producing, and add one review gate before you ship. The philosophy is the same as the rest of this book: never ship something you don't understand — and security is the place where not understanding costs the most.