Shipping fast with AI is great. The security gap is real.
Vibe coding means building software fast with AI tools, often with no security team in the room. Those tools optimize for a working app, not a hardened one, so the same handful of gaps show up again and again. Here is what actually goes wrong, and how to see it on your own app.
Not exotic attacks. The same missing basics.
Across thousands of passive audits of AI-built apps, the most common findings are rarely dramatic exploits. They are hardening that was never switched on.
Missing security headers
The most common finding by far. Headers like Content-Security-Policy, X-Frame-Options, and HSTS are off by default, so most AI-built apps ship without them.
Weak email and DNS setup
No DKIM selector, DMARC not enforced, DNSSEC disabled. It lets your domain be spoofed and hurts deliverability, and almost nobody sets it up by hand.
Exposed files and config
A stray .env, a source map, a public storage bucket, or a debug endpoint left reachable. Small oversights that hand an outsider a real foothold.
Secrets in the browser
API keys and tokens shipped in client-side JavaScript, where anyone can read them. Easy to do by accident when moving fast.
What a passive scan catches, and what it can't.
- Missing or misconfigured security headers
- Weak DNS and email security (SPF, DKIM, DMARC, DNSSEC)
- Exposed files, config, and public storage
- Leaked secrets in client-side JavaScript
- Exposed admin interfaces and API surface
- Broken authentication logic behind a login
- Missing row-level security in your database
- Anything that needs your source code to assess
- Vulnerabilities that require an actual attack to find
We say this plainly. A clean passive scan is a good result, not a full bill of health. See exactly where the limits are →