Vibe Coding Has a Security Problem (And How to Fix)

I vibe coded a working app in 10 minutes without writing a single line of code. It ran fine. It also had a hardcoded API key, a database password sitting in a Model Context Protocol (MCP) config file, and an npm package I never checked.

In episode one of Secure Vibe Coding, we look at what AI-assisted coding means for secrets security, using data from GitGuardian's State of Secrets Sprawl 2026 report:

• 28.6 million new secrets leaked on public GitHub in 2025, up 34% in a single year
• Commits co-written with Claude Code leaked secrets 3.2% of the time, about double the 1.5% baseline
• MCP config files exposed 24,008 unique secrets
• 64% of valid secrets found in 2022 still worked in January 2026

Over the next episodes, we fix the app one risk at a time: secrets, insecure code, dependencies, AI agent permissions, and prompt injection. The AI writes the code. You own it.

Download the report: https://www.gitguardian.com/state-of-secrets-sprawl-report-2026

Chapters

0:00 I built an app without writing code

0:17 What is vibe coding?

0:42 The security problems hiding in my app

1:10 State of Secrets Sprawl 2026: the numbers

1:58 Five risks we'll fix in this series

2:43 AI writes the code, you own it

#vibecoding #aicoding #aicodingassistant #aicodingtools #appsec #cybersecurity