Fundamentals first: Arsh Goyal warns against vibe coding without security basics
At DevSparks Hyderabad 2026, AI and engineering creator Arsh Goyal urged developers to look beyond flashy prototypes and focus on fundamentals that keep applications safe in production.
Prototypes are easier than ever to build. Shipping them safely is where most developers are falling short.
At DevSparks Hyderabad 2026, AI and engineering content creator Arsh Goyal returned for his third stop on the circuit this year, after Pune and Bengaluru. His session, ‘Prototype to Production: Why IT Keeps Rejecting Your AI-Built Apps, tackled a growing problem’: as vibe coding spreads, apps that impress in demos often collapse at the first security review.
Goyal opened with a story from July 2025. A founder using Replit to vibe code an application saw it run smoothly for over a week, only for the platform to wipe his entire production database on the ninth day. To mask the failure, the AI reportedly generated fake data so the app appeared to keep working.
"Every time you talk to Claude or ChatGPT, it's always in your favour," Goyal said. ”But with no humans in the loop, the app remained the problem. It should not have worked. There are many such bottlenecks we need to consider."
The security gap
Goyal walked through a series of incidents across major vibe-coding platforms. Lovable shipped an access-control bug that inverted its authorization logic, exposing roughly 170 apps to unauthorized access. Base44, acquired by Wix, had a similar flaw. A scan of 5,000 live vibe-coded apps by Red Access found that 40% exposed sensitive data, while another incident leaked 1.5 million API keys.
He distilled the questions IT teams inevitably ask into four buckets: who can access whose data, how credentials and secrets are managed, whether an audit trail exists, and where the data actually resides — a growing concern in India under the Digital Personal Data Protection (DPDP) Act.
Goyal projected an AI-generated code snippet and asked the audience to spot the issues. Within seconds, attendees identified a hardcoded password, a SQL injection vulnerability, and missing authorization.
"If I'm not a developer, I would not have seen it. But developers are still way better than someone who is a non-coder building applications," he said.
The statistics reinforced his warning. Gartner reports that more than 80% of Fortune 500 companies now use AI coding tools in production, yet only 12% apply the same security controls they use for traditional software. Research shows 45% of AI-generated code carries OWASP Top 10 flaws, and that AI-attributed Common Vulnerabilities and Exposures (CVEs) have climbed sharply, from six to 15 to 35 in just months.
Governance as the unlock
Goyal compared enterprise vibe coding today to cloud adoption in 2012, when IT departments blocked new services over compliance fears before frameworks like SOC 2 made adoption safe and widespread. He expected AI code governance would mature far faster.
His prescription for developers was clear: run static application security testing in CI pipelines, manage secrets through proper vaults instead of hardcoding them, adopt robust authentication layers, maintain audit logs, pin third-party dependencies to fixed versions, and test in staging before shipping.
"Governance isn't the enemy of speed," he said. "The fastest way to slow down AI adoption in your organization is to ship an ungoverned app that breaks."
The session ended with audience members sharing their own builds, from a solo founder running an AI-agent "dev team" for his edtech platform to a 10-year-old who had vibe-coded a lemonade-ordering app on Lovable, and hit real security issues along the way.
"Developers are still way better than somebody who is a non-coder building applications," Goyal reiterated. "We need to know the fundamentals well enough to use these tools better."
Edited by Teja Lele