Vibe Coding Is a Security Nightmare: How to Fix It

Originally published on Orthogonal Thinking Three weeks ago I reviewed a pull request from a junior developer on our team. The code was clean—suspiciously clean. Good variable names, proper error handling, even JSDoc comments. I approved it, deployed it, and moved on. Then our SAST scanner flagged it. Hardcoded API keys in a utility function. An SQL query built with string concatenation buried inside a helper. A JWT validation that checked the signature but never verified the expiration. All wrapped in beautiful, well-commented code that looked like it was written by someone who knew what they were doing. "Oh yeah," the junior said when I asked about it. "I vibed that whole module." Welcome to 2026, where "vibe coding" isn't just a meme—it's Collins Dictionary's Word of the Year for 2025, and it's fundamentally reshaping how we think about software security. What Exactly Is Vibe Coding? The term was coined by Andrej Karpathy, co-founder of OpenAI and former AI lead at Tesla, in Februar