Vibe Coding with Claude: A Security-First Guide to AI-Assisted Development

Vibe coding is a new development paradigm where you describe what you want in natural language, and an AI assistant like Claude writes the code. Instead of typing every character, you "vibe" with the AI—iterating through conversation until the code matches your vision.

It's fast. It's intuitive. And it's changing how we build software.

But there's a catch: AI-generated code often contains security vulnerabilities that human developers wouldn't make.

Claude (made by Anthropic) stands out among AI coding assistants for several reasons:

Strengths

• Contextual understanding: Claude can hold long conversations and remember project context
• Reasoning ability: It explains its choices and can discuss trade-offs
• Safety training: Claude is trained to be helpful, harmless, and honest
• Code quality: Generally produces cleaner, more idiomatic code than competitors

Limitations

• Security blind spots: Like all AI, Claude optimizes for functionality over security
• Training data: Learned from internet code, including vulnerable examples
• Context gaps: Doesn't know your specific security requirements or threat model

Based on thousands of scans, here are the vulnerabilities we see most often:

1. SQL Injection

Claude often generates string interpolation for database queries:

// Claude might generate this (VULNERABLE)
const user = await db.query(SELECT * FROM users WHERE email = '${email}')
// What you actually need
const user = await db.query('SELECT * FROM users WHERE email = $1', [email])

2. Missing Input Validation

// Claude-generated API route (VULNERABLE)
export async function POST(request: Request) {
  const { userId, amount } = await request.json()
  await transferFunds(userId, amount) // No validation!
}
// Secure version
export async function POST(request: Request) {
  const body = await request.json()
  const { userId, amount } = schema.parse(body) // Validate with Zod
  if (amount <= 0 || amount > MAX_TRANSFER) {
    return new Response('Invalid amount', { status: 400 })
  }
  await transferFunds(userId, amount)
}

3. Hardcoded Secrets

// Claude sometimes includes placeholder secrets
const stripe = new Stripe('sk_live_xxxxx') // NEVER do this
// Always use environment variables
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY)

4. Missing Authentication Checks

// Claude might forget auth (VULNERABLE)
export async function DELETE(request: Request) {
  const { id } = await request.json()
  await db.delete(posts).where(eq(posts.id, id))
}
// Always verify the user
export async function DELETE(request: Request) {
  const user = await getCurrentUser()
  if (!user) return new Response('Unauthorized', { status: 401 })
  const { id } = await request.json()
  // Verify ownership
  const post = await db.query.posts.findFirst({
    where: and(eq(posts.id, id), eq(posts.userId, user.id))
  })
  if (!post) return new Response('Not found', { status: 404 })
  await db.delete(posts).where(eq(posts.id, id))
}

1. Be Explicit About Security

Don't just say "create a login endpoint." Instead:

> "Create a login endpoint with rate limiting, secure password comparison using bcrypt, and protection against timing attacks. Use parameterized queries and return generic error messages that don't reveal whether the email exists."

2. Ask Claude to Review Its Own Code

After Claude generates code, ask:

> "Review this code for security vulnerabilities. Check for SQL injection, XSS, CSRF, authentication bypasses, and any OWASP Top 10 issues."

Claude will often catch its own mistakes when prompted.

3. Use a Security Scanner

Automated scanning catches what both you and Claude miss. ShipReady scans your entire codebase and identifies vulnerabilities with plain-English explanations and copy-paste fixes.

4. Establish Security Patterns Early

Create a CONVENTIONS.md file in your project:

# Security Conventions
All database queries MUST use parameterized queries
All API routes MUST verify authentication
All user input MUST be validated with Zod schemas
Never log sensitive data (passwords, tokens, PII)
Always use environment variables for secrets

5. Review Before Commit

Vibe coding is fast, but take 2 minutes to review generated code:

• Are all inputs validated?
• Is authentication checked?
• Are queries parameterized?
• Are secrets in environment variables?
• Are error messages generic (not leaking info)?

Vibe coding with Claude is incredibly powerful. You can build in hours what used to take days. But speed without security is technical debt waiting to become a breach.

The solution isn't to stop using AI—it's to pair AI speed with automated security scanning.

Write code with Claude. Ship with confidence using ShipReady.