Vibe Coding Security

This module provides an overview and learning objective for Vibe Coding Security course.

AI coding assistants generate working software faster than ever. They do not generate secure software by default. This module explains why — and sets up the mindset and workflow the rest of the course is built on.

AI-generated code is not randomly insecure. It is systematically insecure, for three predictable reasons: biased training data, insecure defaults, and incomplete context. Understanding the mechanism helps you anticipate the failure before it ships.

The cheapest place to fix a security problem is before any code exists. This module introduces STRIDE — a structured threat modelling framework — and shows how to use it to find threats at design time and turn them into prompt constraints.

A prompt is a specification. If it omits security requirements, the output omits security controls. This module shows how to translate STRIDE findings into explicit constraints that produce fundamentally different — and more secure — AI output.

AI-generated code looks polished enough to suppress a reviewer's critical instinct. This module gives you a structured review process built around STRIDE, taint analysis, and threat model validation — and shows how to use AI as an adversarial reviewer alongside your own analysis.

Learn to trace untrusted data from its entry point through your code to the dangerous operation it reaches. Using AI as your analysis tool, you will map every source-to-sink path in a vulnerable Flask application and document what an attacker could do with each one.

Apply the full secure code review workflow to a real pull request. A new feature has been added to DocVault by an AI assistant with no security constraints. You will use STRIDE, taint analysis, and threat model validation to find the vulnerabilities, document your findings, and use AI to generate and review the fixes before the feature merges.

Static analysis tools provide consistent, codebase-wide coverage that manual review cannot match. This module shows how to integrate opengrep into your vibe coding workflow, configure rules that target AI's most common failure modes, and interpret scan output correctly.

Run a static analysis scanner against the same application and interpret what it finds — and what it misses. By comparing the automated scan results against your manual taint analysis, you will understand where SAST is reliable and where human analysis is still required.

AI generates tests that confirm the happy path. This module teaches you to write the tests AI skips — adversarial inputs, boundary conditions, and access control scenarios — and how to use AI with the right prompt to generate them at scale.

Use AI to generate security tests that probe an application under adversarial conditions rather than normal use. You will practise writing the kind of tests AI does not produce on its own — tests that fail on a vulnerable application and confirm a vulnerability exists.