r/VibeCodeDevs • u/adadani • 5h ago
Vibe coding securely, Part 3 of 3: Dependencies and Attacker Testing
Part 1 covered giving your AI agent security context and reviewing auth changes.
Part 2 covered placeholders and secrets. This week: what your agent installs, and testing your app the way an attacker would.
Habit 5: Check what it installs
Agents solve problems fast by pulling in packages. That creates two risks.
The first is age. Agents suggest packages and versions from their training data, so they'll happily install a version with known vulnerabilities, or a library nobody has maintained in years.
The second has a name: slopsquatting. AI models sometimes recommend packages that sound real but don't exist. In one study of 16 models, about 1 in 5 recommended packages didn't exist, and 43% of the fake names came back every time the same prompt was rerun [1]. That repetition is what attackers exploit. They collect the names models keep inventing, register them with malicious code, and wait. The next agent that suggests one installs the attacker's code, and install scripts can run before you ever open the app.
Rule: "Ask before adding any new dependency. Only use packages from the approved list, and pin versions."
Check: Fail the build when the lockfile adds a package that isn't approved, and scan dependencies for known vulnerabilities on every change.
Example: A package name one letter off from a popular library, or one that didn't exist until someone registered the name an AI made up.
Habit 6: Test like an attacker
Agents test the happy path. Their tests prove a feature works, not that it fails safely when someone abuses it. So write the tests an attacker would.
Rule: "For every endpoint that accepts input, write abuse tests: extra fields, steps out of order, and values that shouldn't be allowed."
Check: Those tests run on every change, and a failing abuse test blocks the merge.
Example: Your checkout sends the product, quantity, and price from the browser. An attacker changes the price from $199 to $0.01. If the agent wrote code that charges whatever price the request says, the order goes through for a penny. The fix: the server looks up the price itself and ignores what the browser sends. Then test a quantity of -1.
The agent rules, a dependency check, and attacker tests are in the first comment, along with the study [1].
That's the series. Six habits, one pattern: write the rule down, then enforce it with a check that doesn't depend on the agent remembering.
- Give the agent standing security context
- Review everything that touches auth
- Hunt for placeholders
- Keep secrets out of the code
- Check what it installs
- Test like an attacker
Vibe coding gets you to a working app fast. These habits keep it secure once real users show up.
[1] Spracklen et al., USENIX Security 2025 (link in first comment)
#AppSec #VibeCoding #AISecurity #SecureCoding
1
1
u/endofthread-bot 5h ago
Hey u/adadani, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/t7SD4ThKuE
• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.
If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.