The term "vibe coding" has spread across the tech world since early last year, after OpenAI co-founder Andrej Karpathy wrote about his experience of generating code by just talking to an AI model without really thinking about the code itself. "I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works," he wrote in the X post that sparked the term.

In the tech industry, vibe coding is now the new normal. While it's a powerful way to move faster with less resources, generating code with AI that you don't fully understand or haven't reviewed can pose serious security risks to yourself, your devices and anyone using your app. The AI app-focused cybersecurity firm Apiiro says it looked into Fortune 50 companies and found that vibe coding makes engineers four times more productive but resulted in ten times the number of security issues. So don't vibe-code without following these basic security best practices.

Treat the AI model like you would a lazy genie. Many AI models will take quick shortcuts to technically deliver what you asked for but without implementing safety measures or double-checking work. Don't assume the AI will keep critical information private, implement cybersecurity best practices or check its code for potential exploits.

Spell out what you want with as much specificity as possible, including privacy specs, limitations on who can access what part of what you're creating and other security guardrails and protections you want added to the project, like encryption.

Source link