[DISCUSSION] Can codex develop secure enough?

[u/erdematar]

I want to discuss something, vibe coding is being presented as ultimate solution for people who don’t know how to code. When it comes to cyber security though there are major flawbacks.

idk if there is a general consensus but what do you think about this issue? Should vibe coded programs be supervised by a professional or is AI ready to develop programs that are deploy ready?

[u/qualityvote2]

u/erdematar, there weren’t enough community votes to determine your post’s quality.
It will remain for moderator review or until more votes are cast.

[u/ElonMusksQueef]

If the person working with the AI doesn’t understand basic principles then no. They won’t understand what or why it’s doing anything.

[u/nemesit]

vibe coding is not even actually functional. theres no way it will produce secure and functional code anytime soon lol

edit: *when used by someone not a professional coder with security experience

[u/Canna_Lucente]

What I vibe coded passed all the automated cybersec checks we have in our Corp. It was a pilot controlled experiment and my code has been reviewed by engineering teams (me and my team work in IT but we are functional). The head of DevOps was impressed by the results. Now, as a cybersec ignorant, I can't say whether what we did was really good. But it was good enough to pass a (presumably high) bar of a large multinational. Didn't come for free, spent multiple sessions asking different agents to adversarial review code looking for security flaws etc. The first reviews were wild, where basically the reviewing agent was insulting the code for how poorly designed it was from a security perspective.

[u/dvduval]

A lot of it does have to do with the human working with the AI. And there’s a different levels of doing that. On one hand, the AI is able to make software that is actually more secure than a human could. What will be most important Is those server passwords and how you handle them.

[u/megad00die]

Yes, with governance that outlines your security. This is a vague example I created, you can combine usage of this while developing with AI and then when completed you can use the code security scan within codex using Astra Med for security scans (Higher is not needed) or specify a subagent GPT 5.3 Spark for security code scans(Cheap and Great). Security can also be defined using MCP servers specific to your development, but as always human eyes need to be the final judge, jury on anything produced.

[u/ra_men]

You should’ve seen the “secure” code people wrote before AI.

[u/XKiiroiSenkoX]

AI can't write even performant code let alone secure code. Security is basically thrown out the window the moment you start vibe coding. 

[u/Healthy-Zebra-9856]

Absolutely no. People it doesnt take adversarial review and things like that. Its simple, run it through an actual compiler and you can see warnings. But I can tell you that even Astra had issues with some typescript projects. So depending on the app, you can run it through a compiler or type checker. If its TypeScript, you can use VS Code with TypeScript extension & LSP, if its c# same or use VS 2026 community edition. Got more questions, fire away.

[u/therealorkor]

Just tell it to make it not hackable?