Vibe coding produces code that works. That doesn't mean code that's safe. What nobody tells you before pushing your prototype to production.
An app built in three hours, running, doing exactly what you asked. That's the promise of vibe coding, and it holds. But 'it works' and 'it's safe' are two different things — and the second one doesn't show up on screen.
Last month, Cloudflare — which runs around 20% of the internet's infrastructure — published a report that should make everyone think. With early access to a new model, as part of the Glasswing project, they asked it to hunt for flaws in their own tools. Where previous models found isolated vulnerabilities, this one managed to chain them into a complete attack.
If an AI can chain your application's flaws into a complete attack, assume an attacker can too.
Why generated code is a sieve by default
The model optimises what you ask it for: a feature that works. You didn't ask it to think about the attacker — so it doesn't. The result: the same holes come back every time. API keys in clear text in the code sent to the browser, a database reachable without authentication, client data moving around unchecked, a storage bucket left public. None of this shows up when you test the app: it works perfectly. The flaw stays invisible until the day someone goes looking for it.
And the non-tech person who built the app has no way of knowing. That's not a criticism — it's precisely vibe coding's blind spot. The friction between idea and product has vanished; the friction between product and safe product is still there. It just became invisible.
Vibe coding isn't the problem
Let's be clear: I spend my days building with these tools. The problem isn't vibe coding. The problem is pushing a vibe-coded prototype to production without a security pass, as if it were finished. The prototype proves the idea holds. It doesn't prove it withstands users, audits and bad actors.
What we do, concretely
- Secrets server-side, never in the browser. An API key in the front-end is a key handed to everyone.
- Authentication before data. We wire up no real data until access is locked down — not 'later', right now.
- Turn Cloudflare's weapon against the flaw: have AI audit your app. The same model that can chain flaws can find them in your code before the attacker does. It's a reflex, not a luxury.
- A security layer present everywhere, not a 'security' phase bolted on at the end. That's exactly what our V2P method formalises: quality and security run across all five phases, they're not a sprint added when there's time left.
Vibe coding democratised building. Good. But between a prototype that works and a system exposed to real users, there's a craft — and that's exactly where we step in. Speed without security isn't speed. It's a debt you'll pay, with interest.
François is Dotika's CTO. He writes about what holds, what breaks, and what nobody says when a prototype goes to production.