Vibe coding is fast. That is the point.
You describe what you want, an AI coding agent writes the implementation, and a working feature appears before you have finished your coffee.
The uncomfortable question is what happens next.
Can you explain what the generated code can access? Can you tell whether a pull request contains instructions aimed at the agent rather than the reviewer? Do you know which tools the agent can call, which credentials are in scope, and what happens if untrusted input reaches one of those tools?
That is the security review AI-built software needs.
Vibe coding can be safe. But the unit that needs review is no longer only the code. It is the entire path from generated code and repository content to the capabilities that code can invoke.
The path is the risk
An AI-built application may contain a harmless-looking prompt, a repository instruction file, an MCP server, a credential, and a deployment workflow. Each item can look acceptable when reviewed alone. The risk appears when they connect:
Untrusted content → Agent context → Tool permission → Credential → External side effect
The final side effect might be a deployment, a data transfer, a pull request update, a package publish, or a change to an external system. The important question is not whether one file contains a suspicious string. It is whether attacker-controlled content can influence a consequential action.
What AI-built applications need before they ship
1. A review of the generated code
AI coding agents are good at producing code that compiles and follows familiar patterns. They are not automatically good at inferring requirements that were never stated.
An endpoint generated to delete a user may work perfectly while missing authorization. A profile form may accept every field in the request body rather than the small set the UI intended to expose. A database query may be interpolated because the prompt asked for a search feature, not because anyone intended to create an injection flaw.
The first control is still ordinary application security: validate input, authorize every sensitive action, parameterize queries, protect secrets, and pin dependencies. The difference is that the code now arrives faster than a person can safely review it line by line.
2. A review of repository content
Pull requests, issue comments, README files, changelogs, and agent instruction files are not automatically trusted because they live in a Git repository. A pull request can contain text written to influence the coding agent that reads it.
OpenAI describes prompt injection as a third party misleading an AI system by inserting malicious instructions into its context. In a development workflow, the third party may be an external contributor, a dependency author, or anyone who can modify content the agent will ingest. OpenAI explains prompt injection.
Treat repository content as data first. Keep trusted instructions separate from content under review, and make the boundary visible to the agent and the human reviewer.
3. Narrow agent permissions
An agent that only needs to inspect a diff does not need shell execution, package installation, deployment access, or a production credential. Read-only access is not a complete solution, but it reduces the number of paths an injected instruction can reach.
Use least privilege at the runtime boundary, not only in the prompt. Restrict filesystem scope, network egress, environment variables, and subprocess access. Require a human approval step before high-impact actions.
4. Careful MCP and tool design
MCP makes it easier for an AI application to discover context and call external tools. The protocol specification explicitly notes that tools can represent arbitrary code execution and says hosts should obtain user consent before invoking them. Read the MCP security guidance.
Prefer named operations over primitives. A tool called get_order_status with typed arguments is easier to constrain than a generic run_sql, shell, or write_file tool. Allowlist the tools each workflow needs, review tool descriptions as part of the security boundary, and pin the servers and versions you trust.
5. A release gate that checks the path
Security checks should run after the agent has written the code and before the change merges. A scanner can identify suspicious patterns in routes, dependencies, workflows, prompts, and tool definitions. That is valuable, but a detection is not the same as a confirmation.
The useful follow-up questions are:
- Is there an actual request handler or executable path?
- Does the untrusted value reach a sensitive sink?
- Which tool and credential are available at that point?
- Is a control present, and does it apply to this path?
- What external action could happen next?
Ship Safe keeps deterministic findings visible and treats the optional Kimi K3 review as advisory context. The model can explain or dispute a finding, but it cannot suppress the deterministic result.
A practical pre-merge checklist
Before merging AI-generated code, ask:
1. What untrusted content can the agent read?
2. What tools can it call without approval?
3. Which credentials, files, and network destinations are in scope?
4. Can a repository instruction or pull request change the agent’s behavior?
5. Can the resulting path write, deploy, publish, or send data externally?
6. What evidence proves the path is blocked or safely constrained?
If the answer to the last question is only “the pattern did not appear,” keep investigating. A quieter report can mean a real fix, but it can also mean the check stopped seeing the path.
Is vibe coding safe?
It is safe to the extent that the generated code, the agent, and the surrounding workflow are reviewed together. The speed is not the danger. The danger is allowing working code to end the review process before anyone asks what the new capability can reach.
Run a local scan after an AI coding session, review the permissions around the agent, and keep consequential actions behind explicit approval. Ship Safe scans application code, dependencies, CI workflows, agent configuration, MCP surfaces, and repository content before a change merges.
For the deeper model, read Your AI Coding Agent Is Part of the Supply Chain. The core idea is simple: security is not only a property of a file. It is a property of the path.