5 Security Mistakes Every Vibe Coder Makes

By WolfPack Solution · March 2026 · 4 min read

AI writes code fast. It doesn't always write it safe.

42% of AI-generated code contains vulnerabilities (Stanford/McKinsey, 2025). If you're building with Cursor, Windsurf, Bolt, or any AI coding tool, you need to know what to check.

Mistake #1: Hardcoded API Keys

The fix: Use environment variables. Every framework supports them.

• Create a .env file for your keys
• Add .env to your .gitignore (so it never hits GitHub)
• Access keys via process.env.MY_API_KEY

Check right now: Search your codebase for any string that looks like sk-, pk_, or Bearer. If you find them in code files (not .env), move them immediately.

Mistake #2: No Input Validation

AI builds forms that accept whatever users type. That means SQL injection, XSS attacks, and data corruption.

The fix: Tell your AI tool: "Add input validation and sanitization to all user inputs." Then verify it actually did it.

• Email fields should validate email format
• Number fields should reject non-numbers
• Text fields should sanitize HTML (prevent XSS)
• File uploads should check file type and size

Mistake #3: Authentication Shortcuts

AI will build a login system that "works" but stores passwords in plain text, doesn't rate-limit login attempts, or uses weak session tokens.

The fix: Don't build auth yourself. Use a service:

• Clerk — easiest, free tier for 10K users
• Supabase Auth — if you're already using Supabase
• NextAuth.js — if you want self-hosted

Mistake #4: CORS Wide Open

When your API doesn't work from the frontend, the AI's first instinct is to set Access-Control-Allow-Origin: *. This means any website in the world can call your API.

The fix: Set CORS to only allow your own domain:

Access-Control-Allow-Origin: https://yourdomain.com

Mistake #5: No Rate Limiting

Without rate limiting, anyone can hit your API thousands of times per second. This means:

• Your API costs explode (especially if you're calling OpenAI/Claude)
• Your server crashes under load
• Attackers can brute-force endpoints

The fix: Add rate limiting from day one. Most frameworks have middleware for this. Even a simple "100 requests per minute per IP" stops 90% of abuse.

The 60-Second Security Audit

Before you deploy anything, check these 5 things:

1. ☐ No API keys in code (all in .env)
2. ☐ .env is in .gitignore
3. ☐ User inputs are validated
4. ☐ Auth uses a library/service (not custom)
5. ☐ CORS isn't set to * in production

If all 5 pass, you're ahead of 80% of vibe-coded apps.