Five Old Hacker Habits Every Vibe Coder Needs Now
Vibe coding with AI moves fast but skips security basics. These five classic hacker habits close the most common vulnerability gaps in AI-generated code.
The Wisdom the AI Did Not Learn
There is a 30-year-old body of knowledge about how to write code that does not immediately become someone else's foothold. Most of it was learned the hard way, through public defacements, worm outbreaks, and stolen databases. AI assistants were not trained on the lessons, only on the code.
Vibe coding, the practice of prompting your way to a working application without fully understanding every line, is fast and genuinely useful. It is also producing a generation of codebases that skip the security fundamentals that hardened developers internalized over decades.
Here are five habits worth reviving.
1. Never Trust Input, Anywhere
Every piece of data that crosses a boundary, from HTTP request to database query to shell command, should be treated as hostile until proven otherwise. AI-generated code frequently passes user input directly into downstream operations because the prompt said "make it work" and not "make it safe."
# What your AI generated
def get_user(user_id):
return db.execute(f"SELECT * FROM users WHERE id = {user_id}")
# What you need
def get_user(user_id: int):
return db.execute("SELECT * FROM users WHERE id = ?", (user_id,))
Parameterized queries, input length limits, and type coercion are not optional extras. They are the baseline.
2. Principle of Least Privilege for Everything
Old-school sysadmins were religious about this: a process should have exactly the permissions it needs to do its job, nothing more. AI-generated IAM policies, database users, and file system permissions routinely ask for broad access because narrowing them requires knowing the full application behavior upfront.
Before you ship, ask: does this Lambda function actually need s3:*? Does this database user need GRANT ALL? The answer is almost always no.
3. Log What Matters, Not Everything
Early web developers learned to log failed login attempts, unexpected input values, and privilege escalation paths. Modern AI-generated apps often log verbose application state for debugging but miss the security-relevant events entirely.
A useful rule: if you would want to know about it during an incident, log it now. Failed authentication, unexpected parameter values, and access to sensitive routes should produce structured log entries that your monitoring can query.
4. Treat Dependencies as Attack Surface
The 1990s worm writers targeted default installations of common software. Today the equivalent is a malicious npm or PyPI package in your dependency tree. AI assistants suggest packages based on training data that may be months or years old, and they do not validate package provenance.
# Before installing any AI-suggested package
npm info <package> | grep -E 'maintainers|version|time'
# Look for: recent maintainer changes, suspicious version bumps, missing source links
Pin your dependencies, use lockfiles, and run a supply chain scanner on every pull request.
5. Read the Error Messages
This sounds obvious but it is the habit most often abandoned in the vibe coding workflow. When you iterate on a prompt until the tests pass, you stop reading what the failures actually said. Error messages from security libraries, TLS handshakes, and authentication middleware contain the information you need to know whether your implementation is correct or merely functional.
A working OAuth flow that leaks state to logs is not a working OAuth flow. A TLS connection that ignores certificate errors is not a secure TLS connection. The error output tells you the difference.
Combining Old Habits with New Tools
The good news is that these habits combine well with automation. Static analysis can enforce parameterized queries and flag overprivileged IAM. Dependency scanning catches supply chain risks. Structured logging makes security events queryable. The old wisdom points you at what to automate; the tools do the enforcement at scale.
AI assistants are genuinely useful collaborators. They work best when you bring the security instincts they lack.
Key Takeaways
- AI-generated code skips security fundamentals like input validation and least privilege because the prompts do not ask for them.
- Classic security habits, including untrusted input, minimal permissions, and dependency scrutiny, apply directly to vibe-coded projects.
- Automation enforces these habits at scale so that manual review is a check, not the only defense.