# Security risks and safeguards for vibe-coded applications

DevFeed: [Security risks and safeguards for vibe-coded applications](<https://devfeed.tech/articles/the-vibesec-reckoning-4426.md>)

Original publisher: [Read original article](<https://martinfowler.com/articles/vibesec-reckoning.html>)

Author: Martin Fowler (martin@martinfowler.com)

Published: 2026-05-27T14:03:00Z

Content type: opinion

Language: en

Sources: [Martin Fowler](<https://devfeed.tech/sources/martin-fowler.md>)

Topics: [Vibe coding](<https://devfeed.tech/topics/vibe-coding.md>), [Security](<https://devfeed.tech/topics/security.md>), [AI Development](<https://devfeed.tech/topics/ai-development.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Code](<https://devfeed.tech/topics/code.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Repl.it](<https://devfeed.tech/topics/replit.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [claude](<https://devfeed.tech/tags/claude.md>), [coding](<https://devfeed.tech/tags/coding.md>), [permission](<https://devfeed.tech/tags/permission.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [replit](<https://devfeed.tech/tags/replit.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [security](<https://devfeed.tech/tags/security.md>), [software](<https://devfeed.tech/tags/software.md>), [vibe-coding](<https://devfeed.tech/tags/vibe-coding.md>)

## AI overview

The article examines security problems encountered while scaling a vibe-coded application built with Gemini, Replit AI, and Claude AI. It describes risks including public storage access and excessive token permissions, and recommends security context files, cautious permission handling, security intelligence feeds, and secure-by-default harnesses and templates.

## Source excerpt

Vibe coding has significantly accelerated software prototyping but AI agents frequently recommend insecure configurations, creating security problems. Gautam Koul, Lucian Moss, Neil Drew-Lopez, and Daberechi Ruth Edeokoh share their experience while building applications for Thoughtworks's global marketing. They learned that to combat this we need to write a security context file to guide the AI, be cautious with AI permission requests, create a daily security intelligence feed, and provide builders with a secure-by-default harness and templates. more...