You asked an AI to build a login system. It spat out clean-looking JavaScript in seconds. You merged it. Three days later, your production database is leaking user emails because the AI hallucinated a package name that didn't exist, and some clever attacker registered that exact name with a backdoor inside. This isn't a hypothetical; it's the new reality of vibe coding.
Traditional code reviews assume a human wrote the code, meaning there's a brain behind the logic checking for obvious mistakes. When AI generates code through conversational prompts, that safety net vanishes. The model doesn't "know" what it's doing; it predicts tokens. This creates unique security gaps where insecure patterns, typosquatting risks, and missing authentication checks slip through because no one was mentally present during the generation process.
Why Traditional Reviews Fail AI Code
If you treat AI-generated commits like standard human commits, you're already losing. Humans make predictable errors. AI makes probabilistic ones. It might forget to sanitize input because the prompt didn't explicitly ask for it. It might use a library version that has a known vulnerability because its training data cut off before the CVE was published. Or worse, it might suggest a dependency that simply doesn't exist yet.
This phenomenon, known as package hallucination, is dangerous. Attackers monitor these hallucinations. If an AI frequently suggests `@cool-lib/auth-helper` but that package isn't on npm, an attacker can publish it first. Your CI pipeline installs it, thinks everything is fine, and boom-you've just installed malware. Standard linting won't catch this. Only rigorous branch protection rules will.
The Core Architecture: Multi-Stage Scanning
To secure vibe-coded repos, you need automated gatekeepers at the pull request level. You cannot rely on post-merge detection. Catching a vulnerability before code merges is significantly cheaper than fixing it in production. Here is the stack you need to enforce:
- SAST (Static Application Security Testing): Tools like Semgrep or CodeQL scan for SQL injection, XSS, and path traversal. Configure them to fail the PR if high-severity issues are found.
- SCA (Software Composition Analysis): Use Snyk or Trivy to check every dependency. This catches vulnerable libraries and license conflicts immediately.
- Secrets Detection: AI loves to hardcode API keys for convenience. Run Gitleaks or GitGuardian on every commit. Block the merge if a token appears in source control.
- DAST (Dynamic Application Security Testing): While harder to implement per-PR, running OWASP ZAP against a staging environment triggered by the PR helps catch runtime issues like CORS misconfigurations.
| Layer | Primary Tool Examples | Catches What? | When to Run |
|---|---|---|---|
| SAST | Semgrep, CodeQL | Logic flaws, Injection, Hardcoded secrets | Pre-commit & CI |
| SCA | Snyk, Trivy | Vulnerable dependencies, Typosquatting | CI on PR |
| Secrets Scan | Gitleaks | API Keys, Passwords in diff | Pre-commit |
| Egress Control | Cloudflare Zero Trust | Data exfiltration via network calls | Runtime/Staging |
Killing the Hallucinated Bypass
One specific risk with vibe coding is the "hallucinated bypass." Sometimes, the AI accidentally deletes a line of code that looks redundant but is actually critical-like an auth middleware check. Because the syntax remains valid, the linter passes. The tests might pass if they don't cover that edge case. The code merges. Security disappears.
To counter this, implement infrastructure-level isolation. Don't trust the code alone. Use tools like NGINX or Cloudflare Zero Trust to gate entry points. Even if the application code breaks security rules, the network layer should block unauthorized access. Additionally, enforce strict dependency pinning. Never allow floating versions in `package.json`. AI often suggests the latest version, which might be unstable or compromised. Pin to exact versions and verify them against a trusted registry.
Enforcing Permissions and Defaults
AI assistants tend to be generous with permissions. They default to `*:*` IAM roles or full database access because it's easier to get the feature working. In a vibe-coded repo, this leads to over-provisioned services. Your branch protection rules must enforce the principle of least privilege.
For database configurations, require Row Level Security (RLS) on every table. AI-generated database setups often ship without access controls, leading to disasters where any user can read any other user's data. Verify that parameterized queries are used exclusively. If you see string concatenation in SQL statements within an AI-generated PR, reject it. No exceptions.
Similarly, check for security headers. AI almost never adds them unless prompted. Enforce a checklist: `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Strict-Transport-Security`. If these are missing from the HTTP response configuration, block the merge. You can automate this check using custom scripts in your CI pipeline.
Supply Chain Defense: Cooldown Policies
Supply chain attacks exploit fresh packages. When an AI introduces a new dependency, it’s often brand new to your ecosystem. StepSecurity and similar platforms recommend cooldown policies. These block newly published npm package versions for a configurable period (e.g., 48 hours). Most supply chain attacks, like the Shai-Hulud campaigns seen in 2025, happen quickly after publication. A cooldown gives the community time to spot malicious behavior before your production environment consumes it.
Furthermore, enable org-wide package search. When an AI adds a dependency, instantly identify if that package exists elsewhere in your organization. If it’s unfamiliar, flag it for human review. Historical exposure tracking also helps determine if you were vulnerable during the window when a malicious package was active.
The Human-in-the-Loop Protocol
Automation is powerful, but it needs direction. Establish clear behavioral guidelines for your AI assistants. Use multi-stage prompting: first, ask the AI to build the feature. Second, ask it to act as a security engineer reviewing its own code for path traversal and remote code execution risks. This self-reflection step catches about 30% of low-hanging fruit.
However, do not rely solely on AI self-review. Maintain a human approval requirement for changes touching authentication, payment processing, or data models. Developers must run tests, lint checks, and update the Software Bill of Materials (SBOM) before completing a feature branch. Treat AI-generated code with the same rigor as third-party dependencies. If it comes from outside your core team’s direct cognitive control, it gets scanned.
Implementation Checklist
Ready to lock down your repositories? Start here:
- Enable Required Checks: Configure GitHub/GitLab branch protection to require passing SAST, SCA, and Secrets scans.
- Block Force Pushes: Prevent history rewriting on main branches to maintain audit trails.
- Set Up Pre-Commit Hooks: Catch secrets and basic linting errors before they even reach the server.
- Audit Dependencies Weekly: Use tools to scan for new vulnerabilities in existing pinned packages.
- Review Egress Traffic: Monitor outbound network calls from CI environments to detect data exfiltration attempts.
What is vibe coding?
Vibe coding is a development practice where programmers use AI coding assistants to generate code through natural language prompts rather than writing every line manually. The developer guides the AI, reviews the output, and integrates it into the project.
Why is branch protection critical for AI-generated code?
AI can introduce subtle security flaws, such as hallucinated dependencies or missing authentication checks, that pass standard syntax checks. Branch protection enforces automated security scanning (SAST, SCA, secrets detection) before code merges, preventing these hidden vulnerabilities from reaching production.
What is package hallucination?
Package hallucination occurs when an AI model suggests a software library or package name that does not actually exist. Attackers can register these non-existent names with malicious code, creating a supply chain attack vector when developers install the suggested package.
How do cooldown policies help security?
Cooldown policies delay the installation of newly published package versions for a set period. This allows time for the community to detect and report malicious updates, protecting projects from immediate exploitation of fresh supply chain attacks.
Can AI self-review replace human code review?
No. While AI self-reflection can catch basic errors, it lacks contextual understanding of business logic and complex architectural constraints. Human review remains essential for critical components like authentication and data handling.