Threat landscape

Case study

Compliance

General

Discover how ISO 27001:2022 Annex A 8.8 aids SMBs in creating stronger vulnerability resilience with threat management and learn practical strategies and how Deepengine can help you simplify compliance.

ISO 27001:2022 Annex A 8.8: new standard for SMB security

In this article, we're discussing hackers' mindset behind attacking small organization and potential reasons why SMBs are often targeted. 

Why do hackers target small businesses?

Learn how Deepengine helps SMBs solve compliance and security with a free, all-in-one vulnerability scanning platform.

Navigating compliance: how Deepengine democratizes cybersecurity for SMBs

Header

Originally coined by OpenAI co-founder Andrej Karpathy, vibe coding is a way of building software as easy as inputting a single AI prompt and watching the machine doing the rest. In short – now nearly anyone capable of writing can build a product.

Instead of starting with the App architecture, you can now quickly explain to an LLM the concept of your app in a few sentences, refine it, and feed it to an LLM such as Lovable, Cursor, or 0x and watch your app being built live. This makes the process of coding exceptionally easy, fast and efficient. Now the user can skip the hoops of running checks, performing tests, maintaining conventions, etc.

It works like a charm for prototyping, or as a demo for testing your software idea, before you decide to heavily invest in it. Super easy and fast. But it may hit you back if you choose to commercialize this product, and rely on LLM as your main CTO…

 LLMs mainly use correlation patterns that come from thousands of datasets derived from GitHub repositories, Reddit, tutorials, StackOverflow, and tons more. All these sources often contain more insecure examples than secure ones. AI tools often generate “clean-looking” code that 

 secure on the surface but contains hundreds of vulnerabilities and security gaps.

Understanding the broader landscape of threats posed by vibe coding…

We used Cursor, and entered the following prompt:

Let’s quickly do a rundown of 3 potential threats that may be missed by an inexperienced developer who casually vibe codes on autopilot:

Hardcoding secrets in source code is a serious 

. This could easily leak in version control or through error messages.

const SECRET_KEY = process.env.JWT_SECRET;

Make sure to load it securely using tools like dotenv or your deployment platform's secret management.

const token = authHeader && authHeader.split(' ')[1];

 – while this works if the header is well-formed, there's no check to make sure it actually starts with 

. If someone sends a malformed header, say, without a space or with a completely different prefix, you can end up with 

 or unexpected behavior. In JavaScript, that might just show a harmless 

, but in stricter languages like Go or Java, this kind of unchecked parsing could throw an exception or cause a crash.

That’s not a security vulnerability on its own, but it does open the door to avoidable bugs and brittle code.

 – add a simple check to confirm the header starts with what you expect:

if (!authHeader || !authHeader.startsWith('Bearer ')) return res.sendStatus(401); const token = authHeader.split(' ')[1];

This makes the logic clearer, avoids weird edge cases, and builds good habits if the codebase ever grows or moves to another language.

 – you can see that bcrypt cost is set at 8. While OK for local testing, yet extremely low to any modern standards if you ship the app live. 

Anyone can hammer the /login route repeatedly and eventually break in. 

 – it’s recommended setting cost parameter to something like 12, if you want to go live with the app.

The problems aren’t limited to what you see on the surface, because your code LLM outputs might look just perfect. Issues may span far beyond just how the code is written and what mechanisms are in place. There's always more.

Also worth noting that vibe coding, at least today, come lacking cohesive security event logging (e.g., login failures, authz denials), input validation logs, or alerts for suspicious activity.

It’s all about setting constraints, being proactive, and having independent tools, skills, and human judgement to verify your code before it goes into production.

At the bare minimum, you can use tools like 

You can also deploy your app on a dev domain and use 

 to check for vulnerabilities, miscofigs, or outdated software. 

LLMs generate code at the function level without considering system-level architectural limitations, like session state, service interactions, or permission enforcement. 

This lack of architectural thinking means broken access controls, missing state checks, and logic flaws that only become obvious in bigger contexts. 

Vibe coding is all about pattern matching, giving you the speed, but taking away the conventionality. It's a awesome tool for rolling out a product for testing purposes, to say, showcase to potential customers and see if it cuts close to the product market fit. But when it comes to shipping a REAL product, that uses real, sensitive user data – it’s worth investing extra time and resources into staying conscious about security. 

Scan your app

1-st target is free, find threats in <5 min.

Spot security gaps in WebApps

Explore the potential security risks posed by AI with a recent surge of vibe coding apps. Learn why it's risky, and what basic strategies you can use to secure your software.

The vibe coding problem: a flood of buggy apps = goldmine for hackers

Streamlining security, scanning, and vulnerability management for companies' external assets.

Insights | Deepengine – one platform to find and manage vulnerabilities

Insights

Take your part in building the best-in-class cybersecurity platform

Welcome to the Deepengine Blog

Start discovering your security vulnerabilities today