In this world of vibe-coding—where developers “fully give in to the vibes” as Andrej Karpathy put it—I’ve been exploring ways to integrate essential security thinking into this new workflow paradigm without sacrificing the speed and flexibility that makes AI-assisted coding so powerful.
The Security Dilemma in Vibe-Coding
Vibe-coding represents a fundamental shift in how software gets built. Instead of meticulously crafting each line, developers describe what they want and let AI generate the implementation. While this approach dramatically accelerates development, it creates blind spots around security considerations that traditional manual code reviews would catch.
Security as an Ambient Capability
This approach represents a shift in how we think about security in the age of AI-assisted development. Rather than treating security as a separate phase or specialized activity, it becomes an available perspective at any moment in the development journey.
The command doesn’t demand attention; it’s there when you choose to invoke it. This subtle difference changes the relationship between development speed and security consideration.
The success of this approach ultimately depends on finding the right balance—security checks that are thorough enough to catch meaningful issues but lightweight enough to use regularly. My experience suggests that small, frequent checks integrated into the natural development workflow lead to better outcomes than infrequent, comprehensive reviews.
As AI-assisted development continues to evolve, these patterns of integrating security thinking directly into the workflow will likely become increasingly important. The separation of concerns (finding issues vs. fixing them) represents a pragmatic accommodation to current AI limitations, but this pattern may shift as models improve in context length and reasoning abilities.
What approaches have you found effective for integrating security thinking into your AI-assisted development workflows? How are you balancing the rapid pace of vibe-coding with the need for robust security practices?