Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vibe Coding: A Pentester’s Dream

netspi.com | blog | #ai-security | #secure-coding | #web-security | #vibe-coding | #vulnerabilities | #ai-generated-code

Summary

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.
Published
Collected

original ↗

Related coverage

blog · netspi.com
What's Happening in the Application Security Arena?
According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.
blog · bugcrowd.com
How vulnerable are vibe-coded apps?
The author built the same app with two LLMs and reviewed the results: vibe coding ships fast, but finite context windows and skipped security reviews can turn velocity into real vulnerabilities.
blog · hackerone.com
The Top 5 Most Common Security Issues I Discover When Reviewing Code
A veteran code reviewer counts down the five security issues he finds most often, starting with PII and secrets leaking into logs and poor cryptography choices, with Python and Ruby examples.
blog · aikido.dev
How to maintain code quality standards with AI code and vibe coding
As AI-written code piles up faster than review can absorb, technical debt compounds until shipping slows; the piece covers pull-request quality checks and why model self-review is not enough.
blog · aikido.dev
Vibe Check: The vibe coder’s security checklist
Vibe coding with AI tools like Cursor, Lovable, and v0 makes shipping fast, but generated code can leak API keys and invite SQL injection. This checklist covers essential safeguards before you deploy.
blog · tenzai.com
Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents
A Tenzai benchmark had five AI coding agents—Cursor, Claude Code, Codex, Replit, Devin—build 15 identical apps, uncovering 69 vulnerabilities including broken auth and SSRF.
back