-black.png){kind=logo}
Artificial Intelligence (AI) today enables coding at an unprecedented speed compared to past years. You can state your requirements and get assistance from AI tools with coding, fixing errors, adding features, and improving an application.
It all sounds quite promising. However, rapid development doesn't necessarily mean safe development. Accepting the code generated by AI without verification can lead to security vulnerabilities.
AI Can Generate Insecure Code
One of the biggest risks with AI-generated code is also one of the easiest to overlook: AI can produce code that works, but isn't secure.
For instance, a program created by an AI application may lack an appropriate way to verify who can access certain information. There could also be problems with input validation or the creation of a vulnerable login mechanism.
This is why AI-generated code cannot be considered complete: someone should always review it to ensure that it meets minimum security standards.
Credentials Can End Up in the Wrong Place
AI tools can also create problems when they're given too much information. Developers often work with API keys, passwords, access tokens, or other credentials. If these details are included in prompts, files, or code, they could be exposed to an AI service or accidentally included in generated code.
A safer approach is to keep credentials outside the code and limit what AI tools can access. It's also important to check what information a coding tool can see before using it on a real project.
Dependencies Aren't Automatically Safe
Software in today’s era usually uses other software libraries and packages to carry out activities such as payment, authentication processes, and data handling.
AI might make recommendations in such areas, but not everything it recommends is reliable. It may recommend an old, insecure, or even a non-existent version of a package. Following these recommendations without checking them first could introduce security problems into the application.
Vibe Coding Can Hide Problems
With AI technology, people with no coding knowledge can now create applications simply by outlining their requirements and leaving the coding to artificial intelligence. If you're wondering what vibe coding is, it refers to this approach: creating applications by describing your requirements in normal language and leaving the coding to artificial intelligence.
Vibe coding is convenient and useful; however, it may make security problems harder to identify. Since you don't know the code being created, you might not detect an insecure setting, extra permission, or leaked information. The more responsibility you give an AI tool, the more important human review becomes.
Privacy Doesn't Stop at the App
Developing software with AI can not only lead to insecure code, but it can also result in privacy issues even before the software development process is complete.
Developers may feed certain customer details, internal documents, code, bug reports, or other confidential data to the AI tool to resolve an issue. Depending on the tool's specifications, it may analyze such data outside the internal environment of the organization.
Before passing any data to the AI tool for coding purposes, it's important to consider the types of data that it collects, how it uses them, and how much control you have over them.
AI Can Create Technical Debt
Speed may also cause issues that have nothing to do with security right away.
AI is capable of creating a huge amount of code very quickly. If the developer keeps adding features without deleting old code or reviewing the overall structure, the code will be bulky and hard to manage.
In a few days, even a small modification can become really tough, as it’ll have to be located within an enormous mess of code.
Testing Still Matters
It's easy to think that a piece of code that works is also tested. This isn't necessarily the case.
The test may be generated by AI, but it can still have weaknesses that affect the software it's supposed to check. For example, it may show that the software works in a particular way under particular conditions, but say nothing about how it works when someone tries to break it intentionally.
It's extremely important to do the code review, security checks, and testing for unexpected behavior yourself. AI can assist here, but it can't do it alone.
Use AI Without Giving Up Control
AI can be a helpful tool in software development. During software development, AI can help write repetitive code, explain unknown functions, debug, and prototype software much faster. However, the crucial thing is still the participation of people. AI-generated code needs to be reviewed and tested.
The objective isn't to exclude AI. The point is to make the best of it and not to assume that a faster and more convenient process automatically makes the software secure.
