“I come in peace. I didn’t bring artillery. But I’m pleading with you, with tears in my eyes: if you fuck with me I’ll kill you all.”

― Marine General James Mattis

War is a tough business. Life, death and country are all on the line. For this reason, soldiers tend to be direct and to the point. General Mattis is known to be even more direct than that.

This is relevant because we are all at war.

Everyone who ever stands up a web site is instantly at war.

It’s a cold war, to be sure. Shadowy operators hiding in the fringes, sabotage, intrigue, lies, deceit. But, it’s a war none the less.

If there is one thing that really scares me about vibe coding it’s the total utter lack of concern that most vibe coding tools have about security. They seem to live in this fantasy land where you can just put software out on the internet and nothing bad will happen.

That is, frankly, insane.

So, here I am. Pleading with you. With tears in my eyes. Don’t do that.

As an exercise, I vibe coded an app with several well known AI tools. I won’t list them to protect the guilty, but for each one, I then put the resulting code into a different AI toolchain and gave this very simple prompt:

Audit the current code for violations of security best practice and give me your top recommendations to remediate. Take no action, audit only.

Do you want to guess how many of them had critical vulnerabilities?

ALL OF THEM.

Yes, every single one was compromised. I don’t mean they didn’t follow the most perfect industry best practice. No, I mean every single one had a wide open door that allowed anyone who cared to simply walk in and take the joint over.

This is why you see computer security professionals freaking out all the time online about Vibe Coding. This is also why they tell you not to put AI generated code into production.

While I share their concerns, I don’t think their answer is correct. We cannot simply put our heads in the sand and pretend that AI coding will go away. No, that’s just not realistic. AI tools are so much faster than coding by hand that they are here to stay.

So, we must educate ourselves.

This really isn’t rocket science. All these things are very well documented.

https://owasp.org/www-project-top-ten/

https://www.cve.org/about/overview

Things like OWASP and CVE are public resources that allow anyone to get educated about web security.

And, since it’s public, you don’t have to be an expert yourself.

OWASP for example, maintains a list of scanners:

https://owasp.org/www-community/Vulnerability_Scanning_Tools

Some are free, some are paid. The point is that these things are out there for you to use. You just need to ask AI to use them. For example:

Develop a detailed plan to do end to end scanning of our project at every commit for security issues by using an open source OWASP scanner.

Or

Use the open source version of semgrep to do CVE scans as part of every check in. Develop a detailed plan for security scanning for our project.

These types of prompts will not fix all issues, but it will put you miles ahead of a random vibe coded application with no security scanning.

I have been in this business for a long time and I can tell you that every site on earth has some issues. When I was a PM for a cloud security tool, we would give the scanner away for free to customers. This was because the scanner ALWAYS FOUND SOMETHING. Always.

The discussion with the customer wasn’t “if you have issues.” It was “you have issues, we’re here to help you manage it.” Large complex sites would routinely have over a thousand open findings at any one time. The software we made helped manage those issues by focusing on the ones that were the most important.

For your site, you should do the same. Evaluate the threat level (or ask your AI to evaluate) and make decisions based on the level of severity. Tackle the most critical ones first. Work on security as a regular part of every sprint. Do regular audits.

This is the one thing you must do: Include security as part of your process or you will inevitably pay the price.