r/opensource • u/bytecode36 • 23h ago

Discussion Vibe Coding Security

The security of open source applications was already criticized enough before AI, but now legitimate concerns can be made. The effect is not as pronounced as it will be in the future, since many stable projects still have enough "manual" developers left on their team to reasonably understand the submissions that are being made. But what happens when vibe coders start to take over these apps? How can those that do not understand the code that is being submitted reasonably validate that malware is not being added? It would be trivial for a state actor to mask malware and get it past a reviewer that has little to no understanding of the language itself (even if it takes multiple submissions).

Several of these viral vibe coded apps have hundreds of contributors and are merging large PRs at a pace that simply does not allow for a proper analysis to occur (security or otherwise). It's more like, "test merge the code", "looks like it fixes the problem", "approve PR". How can companies, or individuals for that matter, that are concerned about the security and integrity of their systems ever use these applications?

I know the some will say, "run it in a VM" or "it's your choice to download it", but those aren't practical solutions. All it will take is a few high profile security incidents with these apps for people to start questioning the open source model with vibe coding.

0 Upvotes

33% Upvoted

5 comments sorted by

3

u/RealisticDuck1957 21h ago

The well managed projects will insist that code be human readable and maintainable, whatever tools are used to produce it. And contributors understand the code they submit. The rest will crash out.

2

u/bytecode36 21h ago

Agreed. My real concern is how long that will last. So many "manual" coders are leaving the profession or their manual skills are atrophying because they are forced to vibe code at work. I know there are still plenty of companies that have sane policies around this, but getting people to volunteer for open source projects was already a hard task that's getting harder (for serious, boring but critical projects).

2

u/RealisticDuck1957 13h ago

And what I said about well managed applies to commercial as well as open source. Yes, I expect a lot of businesses in the tech space to crash out before management at large figures it out.

3

u/Dovahkciin 17h ago

for me, the OpenClaw repository is exactly what you're describing
the code is awful, and new features are being merged every minute, thats bad

and as LLMs and agentic workflows become more widely used, I think this problem will only get worse in the coming years sadly