What I keep finding when I review vibe coded apps

I audited a handful of apps built with AI coding tools this month. In eight years of writing code, I have not seen anything this consistently exposed.

Wide open APIs with zero auth. Secrets sitting in plain sight in git history. No role based access control anywhere, so any logged in user could hit an admin route if they guessed the URL. Almost every app had at least one of these. Most had all three.

None of this means AI coding tools are bad. I use one daily. It means prompting an agent to follow security best practices is not the same thing as verifying it did. That verification step is the part nobody wants to slow down for, and it is exactly the part that matters most before something goes live.