Vibe Coding Made Me Understand Developers Better

For most of my cybersecurity career, I’ve been on the other side.

• I test applications.

• I find something vulnerable.

• I write the finding.

Then somewhere in the report....

• “Developer should implement proper validation.”

• “Developer should enforce authorization.”

• “Developer should not expose this.”

It’s so easy to find faults in someone else’s work.

Then I started vibe coding.

And suddenly I was the developer.

Well... with AI doing a suspicious amount of the typing.

At first, it was fun. Very fun.

I describe what I want.

AI builds it --> I test it --> It works

Then I want another feature. And another...

Suddenly, something breaks. Fix that.

Now another thing breaks. Fix that too.

Then the mobile view looks weird.

Then authentication stops working.

Then the database gives error/warning.

Then Vercel decides today is the day we fight. :(

And somewhere between all of that, I caught myself thinking:

“Okay. Just make it work first.”

...

Oh.

OH.

So this is how it happens....

As a security person, it’s very easy to look at a vulnerability and only see the mistake.

• Why didn't they validate this?

• Why is authorization missing here?

• Why is this API returning that?

• Why would anyone implement it like this?

But when you're building, you're not looking at one isolated security finding.

You're looking at the whole thing.

The feature needs to work. The UI needs fixing.

There are dependencies everywhere.

Something that worked yesterday suddenly doesn't today.

Caught with the deadline too.

And that “small change” somehow touched five other things.

Security? I don't even know when i quickly be, “I’ll come back to that later.”

And I think vibe coding makes this even more interesting.

Because AI can generate something that works incredibly quickly.

Working is very convincing.

We click the button. It works.

You log in. It works.

Data appears. It works.

Deploy successful.

But “it works” and “it works securely” are two very different things.

My cybersecurity brain still interrupts me.

Like...

Can User A access User B's data?

Where is authorization actually enforced?

What does this API expose?

Did I accidentally put a secret somewhere stupid?

What happens if I modify this request?

What exactly did AI implement here?

And now I understand something better than I did before. Sometimes developers aren't ignoring security because they don't care. Building software/Application is messy.

You're constantly balancing functionality, bugs, UX, architecture, dependencies and a hundred tiny decisions.

However, that doesn't excuse insecure software.

But it changed how I look at the person receiving my security findings report.

Instead of asking, “How did the developer miss this?”

I’m starting to ask, “How can we help to make this harder to miss while they're building?”

Maybe that’s the part I was missing all this while.

Breaking applications taught me where software fails. Building applications is teaching me why.

And apparently, all I needed was vibe coding to finally understand the people I’ve been annoying with pentest reports for years.

:)