// ENGADGET — INTELLIGENZA ARTIFICIALE
5 safety practices to know before vibe coding
Here’s what beginners need to know to vibe code securely.
The term "vibe coding" has spread across the tech world since early last year, after OpenAI co-founder Andrej Karpathy wrote about his experience of generating code by just talking to an AI model without really thinking about the code itself. "I just see stuff, say stuff, run stuff, and copy paste stuff, and it mostly works," he wrote in the X post that sparked the term.
In the tech industry, vibe coding is now the new normal. While it's a powerful way to move faster with less resources, generating code with AI that you don't fully understand or haven't reviewed can pose serious security risks to yourself, your devices and anyone using your app. The AI app-focused cybersecurity firm Apiiro says it looked into Fortune 50 companies and found that vibe coding makes engineers four times more productive but resulted in ten times the number of security issues. So don't vibe-code without following these basic security best practices.
Treat the AI model like you would a lazy genie. Many AI models will take quick shortcuts to technically deliver what you asked for but without implementing safety measures or double-checking work. Don't assume the AI will keep critical information private, implement cybersecurity best practices or check its code for potential exploits.
Spell out what you want with as much specificity as possible, including privacy specs, limitations on who can access what part of what you're creating and other security guardrails and protections you want added to the project, like encryption. You can also ask it to reference the OWASP list of top vulnerabilities to help avoid these issues before the code has even been written.
Most AI models will give you the ability to make persistent rules or context files, so you don't have to repeat the same instructions every time you sit down to build. Create a markdown file (.md file) with any AI model or add information to the "Knowledge" section in the Lovable agent or the "Memory" section if you're using Replit. AI markdown files are useful for adding safety guidelines because the AI will consider the file's instructions with every prompt or task. And before getting started, choosing vibe-coding tools that support audit logs can help you track every change to your project more easily.
It's never a good idea to put API keys or passwords directly into an AI prompt. This type of sensitive data should never show up in the code, either, because if you push your code to Github later, all that critical info will be available for anyone to see. Limiting what your AI tool has access to can also help prevent prompt injection attacks.
Instead, store sensitive data in a dedicated password manager and use the "environmental variables" or "secrets" tabs on Replit, Lovable or Vercel. This is the easiest and best method for total beginners.
If the AI tool you're using doesn't have a feature like this built-in already, you will have to make a backend "environmental variable" .env file for this data and make sure that file does not get made public at any stage in the process. This means making it part of a .gitignore file and ensuring it is never visible on the app or website's frontend.
To check if you've done this correctly, you can use TruffleHog, a tool that will check your code to make sure you haven't accidentally leaked sensitive info.