I Started Vibe Coding. But With Extra Security.

Before this, I mostly knew how to break web app.

Find the endpoint - Intercept the request - Change the parameters - Test the access control - See what the application lets me do that it probably shouldn't.

Building one myself? Not really my thing.

Then I discovered vibe coding.

Suddenly, I could actually build the ideas in my head. I describe what I want, work with AI, test it, break it, fix it, and slowly turn an idea into something that actually works.

Pretty fun, actually.

But there's one problem.

I still think like a security person.

So even when the app finally works, my brain immediately starts asking:

Wait. Did I implement authorization properly?

What does this API expose?

Where are my secrets stored?

Can User A access User B's data?

Did AI just generate something that works but shouldn't be trusted?

And that's when vibe coding became even more interesting to me.

Because now I'm not only trying to break someone else's application. I can build something, understand how the pieces connect, and then try to break my own application.

AI can generate a lot of code very quickly. But "it works" and "it is secure" are two very different things.

So now my vibe-coding workflow has an extra step:

Build it → make it work → break it → secure it → break it again

Still learning the building side. Still breaking things along the way.

But maybe that's the fun part.

So, do you vibe code with security in mind?