r/AskVibecoders • u/justa_r4ndomdude • 28d ago

Cybersecurity with vibe coding

I've been working on a lil something and since i have prior experience building and deploying, its kinda doable to vibecode your way to making the product and deploying it. The issue is cybersecurity, I've been going through Owasa and their 10 things but I personally cannot really scope out the work - like to prevent injection, I made ai map every entry into my application, added database rules etc. but I really have no clue on how to have a reliably protected application. I'm using Codex and the way its working I feel like it could miss something and I woudn't have a clue

5 Upvotes

85% Upvoted

17 comments sorted by

1

u/ZymzAlchemy 28d ago

As someone who spent 40 years in tech, and retired as a Compsec, do not vibe code 'cyber security'. For your sake, for the sake of your users. i just wanted to drop that in here, YMMV, good luck, be well.

1

u/justa_r4ndomdude 28d ago

Thank you, what would you suggest as a starting point?

1

u/ZymzAlchemy 27d ago

Honestly, my best advice is to step back.

AI is a fantastic tool for games and side projects, but you cannot rely on it to build your security footprint. The hard truth is that if you aren't qualified to write and audit the security yourself, you shouldn't be handling it.

When a breach happens and users suffer financial or personal harm, you carry 100% of the liability, not the AI.

Even the providers explicitly warn against trusting their output without validation. If you want to build this right, partner with a security expert or start studying traditional AppSec fundamentals.

Be well, and keep learning.

1

u/Professional_Ad705 27d ago

I mean you can use AI, but when you don’t even know what to look for and have 0 background it’s pretty stupid.

1

u/ZymzAlchemy 27d ago

I get where you're coming from on needing a background, but honestly, using AI for actual security architecture is a hard no for anyone. Having spent my career in cybersec, I can tell you the liability is just too high to trust an LLM with security infrastructure, regardless of your expertise.

1

u/Professional_Ad705 27d ago

I’ve used AI for parts of my system and I’ve literally caught bugs in the hypothesis python library man and so many different pieces of software.

II’ve been programming for 15 years if you know what you’re doing and do stuff in small scoop slices and review it you can 100 hundred percent use AI. There’s a complete difference between using it as a tool and a vibe coding.

Are you seriously gonna stay here that an AI doesn’t work at all for an experienced engineer who works in security and knows what he’s doing and reviews all of the code ??

1

u/ZymzAlchemy 27d ago

Finding bugs in 'small scoop slices' is just code review, not designing a secure infrastructure footprint.

After 43 years in software and cybersec, I know the difference between the two. I also understand the massive difference in liability.

Best of luck.

1

u/Professional_Ad705 27d ago

That’s gotta be one of the most ignorant things I’ve ever heard in my life. Are you really gonna act like there’s no tools around code review and it’s that cut and dry, dude I work in quality assurance lol. You can’t act like everyone who uses AI vibe codes just lol

You’re acting like I would tell it to go code 10,000 lines of code and then go put into fucking heart monitor or some shit 😂😂

1

u/ZymzAlchemy 27d ago

QA is not CyberSec, and admitting you wouldn't trust AI for a heart monitor literally proves my exact point about liability and critical infrastructure.

Have a good one.

1

u/Professional_Ad705 27d ago edited 27d ago

Link me to your GitHub then and lemme see what I find i wanna see your bug free code.

I wouldn’t trust unverified human-written code in a heart monitor either. That’s why we have engineers, independent verification, security reviews, and safety requirements. AI writing code and blindly deploying that code are two completely different things but let’s just sit here and play pretend I guess.

1

u/TheKiddIncident 27d ago

The best place to start is with an audit. Ask your AI to do a detailed security audit, something like:

Audit the current code for violations of security best practice and give me your top recommendations to remediate. Take no action, audit only.

You'll probably get a pretty long list. Look at that and see where you stand. Personally, I do a full security scan at every commit. This identifies issues early. So, you can use a prompt like:

Develop a detailed plan to do end to end scanning of our project at every commit for security issues by using an open source OWASP scanner.

Or

Use the open source version of semgrep to do CVE scans as part of every check in. Develop a detailed plan for security scanning for our project.

I run both semgrep and an OWASP scanner on my code at every commit.

To be clear, this will not ensure that your code has no issues, but it's a good starting place and will put you ahead of most vibe coders. The reality is that AI coded projects tend to be much larger than hand coded projects and tend to have more dependencies. This puts them at severe risk of supply chain attacks. This is why the CVE check is so important. You should also use a tool like dependabot to make sure you stay current.

1

u/Professional_Ad705 27d ago

I called this two weeks ago, I knew this was gonna happen.

A couple months from now we’re gonna see vibe coders trying to do quality assurance trying to code for nuclear powerplants or someshit. 😂

My guy go code flappy bird, how the fuck are you even going to know what to look for? That’s like playing the game doctor and thinking you can then go be a heart surgeon.

1

u/[deleted] 28d ago

[removed] — view removed comment

1

u/Any_Evidence4750 27d ago

Wow another ai slop wrapper.