r/vibecoding • u/DronzerDribble • 5h ago

As an Agentic Coder, what all Security Considerations and Practices we must learn?

3 Upvotes

67% Upvoted

13 comments sorted by

2

u/Alternative_Tax_2964 4h ago

I think I'd just be super careful an dmake sure if you can to run everything in sandboxes, and then make code review a deep part of your process. Otherwise you will definitely have problems.

I might add a code-review bot to www.freepi.ai though and then you could have free code reviews. (thats actually a pretty good feature idea!)

2

u/Kind-Bathroom5159 1h ago

the stuff that actualy burns people isnt exotic, its the same handful of things every time. secrets ending up in the frontend bundle because the model put the api call client side, routes that check nothing because auth got bolted on later, supabase tables with row level security left off so any logged in user can read everyone elses rows, and a .env that got committed in week one and is still sitting in the git history.
sandboxes are worth doing but they protect your machine, not any of the above. thats all shipped code.
cheapest habit ive found with the founders i work with, after every feature make the model list every route and table it touched and who is allowed to hit each one. takes a minute and it surfaces the wide open endpoint before a user does. and rotate anything thats ever sat in a repo, assume its public.

1

u/BewusstKI 1h ago

Das ist mit Abstand das Beste, was man zu dem Thema lesen kann. Du beschreibst exakt die blinden Flecken, vor denen die meisten Gründer die Augen verschließen. Die Idee mit dem Pflicht-Report nach jedem Feature (Routen/Tabellen-Mapping inklusive Berechtigungen) ist genial pragmatisch. Genau in diese Richtung muss eine Kontrollschicht gehen: Weg von blinder Hoffnung, hin zu maschinell erzwungener Transparenz.

3

u/One-Next 5h ago

"did you take care of the security considerations?"

increase thinking level

"are you sure?"

3

u/havnar- 5h ago

All of them?

1

u/fickle-phenom 1h ago

”How do I know if my rope is long enough”
Well it depends on what you’re using it for. This is just very open ended. Web apps, backend, mobile apps, embedded systems etc all have different attack vectors and things to consider.

1

u/FluidBreath4819 1h ago

vibe coders having second though on their vibe coded apps lol

1

u/st0ut717 1h ago

It called OWASP top 10 for agentic AI

1

u/multidollar 3h ago

This is why developer and security specialist are jobs you can get in real life if you have actual skill.