AI-Generated Code Security Cheat Sheet — vibe coding, reviewed like an attacker reads it

Reviewed October 25, 2026 — Ingenious AI security checks.

Key facts

• 45% of AI-generated code shipped a real vulnerability in Veracode's 2025 GenAI Code Security Report — the base rate is the argument for reviewing every AI-written diff.
• 7 flaw families cover most of what assistants introduce (next section) — they are patterns, so they can be swept for mechanically.
• A committed secret is a compromised secret: rotation comes before cleanup, every time.

What flaws does vibe coding output usually contain?

Coding assistants optimise for code that runs, not code that resists attack, so the same flaw families recur across projects and languages. Hardcoded secrets, injection sinks, dynamic execution on untrusted input, disabled TLS verification and insecure defaults appear again and again, because the training examples the models learned from contained them too.

• 1. Hardcoded secrets: API keys, tokens and passwords written straight into source or config-shaped code.
• 2. Injection flaws: SQL, command and template injection where user input reaches a sink unsanitised.
• 3. Cross-site scripting: unescaped output rendered into pages, especially in quick demo front-ends.
• 4. Dangerous dynamic execution: eval(), exec(), shell=True and unsafe deserialisation on data the program does not control.
• 5. Disabled security defaults: verify=False, unverified TLS contexts, CSRF exemptions, permissive CORS added 'to make it work'.
• 6. Over-broad permissions: wildcard IAM, public storage buckets and admin-scoped tokens chosen because they never error.
• 7. Missing auth checks: endpoints that work beautifully in the demo because nothing verifies who is calling.

What is the 4-command sweep?

1. Secrets: grep the repo for key-shaped strings (sk-, AKIA, ghp_, xox prefixes). Any hit: rotate first, then remove.
2. Credentials in code: grep for password, passwd, api_key and secret assigned to quoted values, excluding obvious placeholders.
3. Dynamic execution: grep for eval(, exec(, os.system, shell=True and unsafe YAML loads; check what input reaches each one.
4. Disabled defaults: grep for verify=False, unverified contexts, StrictHostKeyChecking no and csrf_exempt. Each hit is a hole with a comment-shaped excuse.

Run the sweep after every AI-assisted coding session, not once per release — the flaws arrive per session, so the check has to as well.

How do you review an AI-written diff?

• Read the diff, not the demo: working output proves the happy path only.
• Chase every new network call, file write and permission the diff introduces — assistants add capabilities silently.
• Ask what the code does with hostile input — empty, enormous, malformed and malicious are the four test cases.
• Keep the sweep in CI so a future session cannot reintroduce a fixed flaw unnoticed.

Run the free check

The fastest way to apply this cheat sheet is the free check on Vibe-Code Audit: it scans your repository for the 7 flaw families and returns a plain-language fix list. Start on the Vibe-Code Audit homepage, compare tiers on Vibe-Code Audit pricing, and keep the full hosted reference open at the AI-Generated Code Security cheat sheet on Vibe-Code Audit. Questions or orders: ask Ingenious AI on WhatsApp or email orders@getingeniousai.com.

Run the free check on Vibe-Code Audit → Open the hosted cheat sheet →