The Most Dangerous Vibe Coding Prompt: “Just Make It Work”

I think one of the most dangerous prompts in vibe coding is also probably one of the most common:

“Just make it work” = "Asal Jadi"

I get it.

When I’m vibe coding, sometimes I don’t care how beautiful the code is. I just want to see the button working. I want the login to work. I want the data to appear. I want to deploy it and see my idea alive.

So I tell AI:

........ Just make it work.

And AI does exactly that.

It works. YEAYY.

However........ That’s the problem.

Because working and secure are two completely different requirements.

If I ask AI to create a feature where users can view their own data, it might successfully build the page, API call and database query.

But did I tell it that User A must never be able to request User B’s data?

Maybe not.

Did I tell it to enforce authorization server-side instead of just hiding things in the UI?

Maybe not.

Did I tell it what information should never be returned by the API?

Maybe not.

Did I tell it where secrets should be stored?

Also.. maybe not.

The AI didn't necessarily fail my prompt. But, my prompt never defined those boundaries in the first place. And this is something vibe coding has made me think about a lot.

When our requirement is only “Make this feature work.” AI optimizes toward making the feature work. But security requirements are often about what the application must NOT allow.

• A user must not access another user's data.

• An unauthenticated user must not reach this endpoint.

• A normal user must not perform an admin action.

• A secret must not end up in client-side code.

• An API must not return more information than necessary.

Those things may not be obvious when you're staring at a feature that appears to work perfectly.

The button works.

The API returns 200 OK.

The data appears.

Deployment succeeds. Everyone is happy.

Meanwhile, my security brain is standing in the corner, “Okay... but what happens if I change this ID?”

😂

That is probably the biggest thing vibe coding has changed for me. I’m learning that prompting isn't only about describing what I want an application to do. Sometimes I need to describe what it must never be allowed to do.

Instead of:

Build a dashboard where users can view their projects.

Maybe my security brain should add:

Users can only access projects they own. Enforce authorization server-side on every request. Do not rely on frontend restrictions. Return only the fields required by the UI.

Still vibe coding.

Just with added boundaries.

Because “it works” is the beginning of testing, not proof that the application is safe.

So now whenever AI gives me something that works, I have another question

“Okay, cool. Now, how can I break it?”

<3 Dani