A Secure Vibe-Coding Checklist Before You Ship

A secure vibe-coding checklist isn’t about slowing down — it’s about knowing which ten minutes of checking save you from a very bad week. Vibe coding gets you to “it works” fast. This checklist gets you from “it works” to “it’s safe to ship,” which, as we’ve argued in Is Vibe Coding Safe?, is a different and far more important milestone.

Run this before every launch and after every large AI-generated change. It’s organised by severity, so if you only have time for the top of the list, you’re spending it where it matters most.

Why AI-generated code needs its own checklist

Generic secure-coding checklists assume a human wrote the code and made human mistakes. AI-generated code fails differently. It rarely fat-fingers syntax, but it routinely omits the security and structural basics no one prompted it to include — and it wraps those omissions in clean, confident, well-commented output that looks reviewed.

So this list targets the specific gaps AI leaves: secrets, authorisation, injection, validation, error handling, dependencies, and hollow tests. Each is something the AI will happily skip while producing code that runs perfectly in a demo.

1. Secrets — the highest-value ten minutes

Exposed credentials are the most common serious finding in AI-generated repos and the fastest to exploit. Check, in order:

• No hardcoded API keys, tokens, or passwords anywhere in the code. AI inlines these to make examples run, and they ship.
• No database connection strings or cloud credentials committed to the repo.
• Secrets loaded from environment variables or a secret store, never literals.
• Git history is clean — a key removed in the latest commit but present in history is still leaked.

If you check nothing else, check this. A single leaked credential can compromise everything behind it.

2. Authorisation — not just authentication

Authentication asks are you logged in. Authorisation asks are you allowed to touch this specific thing. AI reliably handles the first and reliably forgets the second.

• Every data endpoint verifies the caller is entitled to the record, not just that they’re logged in.
• Users cannot read or modify another user’s data by changing an ID in the URL or request body.
• Admin-only actions actually check for admin rights server-side, not just by hiding a button in the UI.

The classic vibe-coded breach is an endpoint that returns any user’s data to anyone who guesses the URL. It passed the demo because you were the only user.

3. Injection and unsafe input handling

These are valid, running code — which is exactly why they pass every linter.

• Database queries use parameterised statements, never string concatenation.
• User input rendered into HTML is escaped, to prevent cross-site scripting.
• No shell commands or file paths built from untrusted input.
• All external input is validated — type, length, and range — before use. Assume every value from a form, URL, or API can be hostile.

The research on how often AI-generated code fails these specific classes is sobering; we catalogue it in Why 53% of AI-Generated Code Ships with Vulnerabilities.

4. Error handling and data integrity

AI loves try/catch blocks that swallow errors and return a hollow success, which hides failures until they’ve corrupted something.

• Errors are surfaced or logged, not silently caught and discarded.
• Failed writes don’t report success. Confirm the operation actually persisted.
• Sensitive details aren’t leaked in error messages returned to users.

5. Dependencies

• No phantom dependencies — packages imported in code but never installed.
• No unvetted heavyweight packages pulled in for a small job; AI reaches for popular, not appropriate.
• Known-vulnerable and abandoned packages removed or updated.

6. Tests that actually test

A green suite feels like coverage. Confirm it is.

• Tests exercise real code paths, not mocks of the logic they claim to verify. An AI-generated test that would pass even if the function were deleted is decoration.
• Critical paths — auth, payments, data writes — have real assertions.

7. Run the whole thing through a scanner

Manual checks catch the obvious. A codebase of any real size has too many paths for eyes alone, and the whole point of vibe coding is that you’re moving faster than manual review can keep up. The last item on the checklist is to automate the rest of it.

Our AI code checker runs five agents across your repository — mapping directly onto this checklist: security and injection, authorisation patterns, dependencies, test coverage, and architecture — and returns an A-F score with a prioritised findings list in under 60 seconds. The vulnerability scanner drills into the secrets, injection, and insecure-auth classes specifically. A repo under 100K lines scans on the free tier, so this final step costs nothing and takes less time than reading a single file.

Treat the scan as the backstop, not the whole process. The manual checks above force you to think about your threat model; the scanner catches everything you couldn’t hold in your head.

The one-line version

Before you ship AI-generated code: no secrets, real authorisation, parameterised queries and escaped output, validated input, visible errors, clean dependencies, tests that test — then scan the whole repo to catch the rest. Ship on a passing grade, not on a passing demo.

FAQ

What should I check before shipping vibe-coded code? In priority order: exposed secrets, missing authorisation, injection and input validation, silent error handling, dependency hygiene, and hollow tests. Then run a full-codebase scan to catch what manual review misses.

Why does AI-generated code need a special checklist? AI rarely makes syntax mistakes but routinely omits security basics no one prompted it for, hidden under clean, confident output. A checklist targeting those specific gaps catches what a generic one assumes a human already handled.

What’s the single most important check? Exposed secrets. Hardcoded API keys and credentials are the most common serious finding in AI-generated repos and the fastest to exploit. Check the code and the git history.

Can I automate this checklist? Largely, yes. A five-agent scanner maps onto most of these items — security, authorisation, dependencies, coverage, architecture — and returns a graded findings list in under a minute. Use it as the backstop after the manual threat-model checks.

---

A passing demo isn’t a passing grade. Run this checklist, then point our scanner at your repo for an A-F score and a prioritised fix list in under 60 seconds — and ship vibe-coded code you’ve actually verified.

Try the scanner · start back at Is Vibe Coding Safe? · compare tools at /compare/ai-code-review-tools · or email codeqa@aivyuh.com. More on the blog.