OWASP Top 10 for Vibe Coders: The Plain English Version

What Is the OWASP Top 10?

OWASP (Open Worldwide Application Security Project) is a nonprofit that publishes free security resources. Their Top 10 list, updated every few years (latest: 2025), is what OWASP calls "a standard awareness document" for web application security risks. Companies of all sizes use it as a reference in security reviews and compliance work, and it is expected knowledge for any software engineer.

Veracode's State of Software Security 2023 found that over 69% of applications had at least one OWASP Top 10 flaw. For AI-generated applications, the percentage is likely higher because AI tools optimize for functionality, not security.

The OWASP Top 10 Mapped to AI Code Patterns

A01: Broken Access Control

This is number one for a reason: in the OWASP Top 10 2025 data, 100% of the applications tested had some form of broken access control, and it had more occurrences than any other category (over 1.8 million). In vibe-coded apps, it looks like this:

// ❌ BAD - No ownership check (any logged-in user can read any record)
app.get('/api/invoices/:id', auth, async (req, res) => {
  const invoice = await db.query('SELECT * FROM invoices WHERE id = $1', [req.params.id]);
  res.json(invoice);
});

// ✅ GOOD - Ownership check ensures users only access their own data
app.get('/api/invoices/:id', auth, async (req, res) => {
  const invoice = await db.query(
    'SELECT * FROM invoices WHERE id = $1 AND user_id = $2',
    [req.params.id, req.user.id]
  );
  if (!invoice) return res.status(404).json({ error: 'Not found' });
  res.json(invoice);
});

A05: Injection

The classic vulnerability. AI tools still generate string interpolation in database queries:

// ❌ BAD - SQL injection via string interpolation
const users = await db.query(`SELECT * FROM users WHERE name = '${req.body.name}'`);

// ✅ GOOD - Parameterized query
const users = await db.query('SELECT * FROM users WHERE name = $1', [req.body.name]);

For React apps, also check for cross-site scripting. Our XSS guide for React and Next.js covers dangerouslySetInnerHTML and the safe alternatives.

A02: Security Misconfiguration

A common pattern in AI-generated code is overly permissive CORS:

// ❌ BAD - Accepts requests from any origin
app.use(cors({ origin: '*' }));

// ✅ GOOD - Whitelist specific origins
app.use(cors({
  origin: ['https://myapp.com', 'https://staging.myapp.com'],
  credentials: true,
}));

How Many OWASP Issues Does Your App Have?

There is no reliable per-tool count, and the number depends on what you asked the tool to build. The best controlled data point is Veracode's 2025 GenAI Code Security Report: across 80 coding tasks and more than 100 models, the generated code introduced an OWASP Top 10 vulnerability in 45% of test cases, and the models failed to defend against cross-site scripting in 86% of cases. The only way to know your own number is to check your code.

How to Check Your App Against the OWASP Top 10

1. Run an automated scan. VibeDoctor's Vibe Check checks your codebase and deployed site for many of these patterns: API routes with no auth middleware, SQL injection, wildcard CORS, leaked secrets, vulnerable dependencies and missing security headers. It generates a report showing exactly which issues are present and how to fix them. Designed specifically for vibe-coded apps.
2. Fix critical items first. A01 (access control) and A05 (injection) cause the most damage. Focus there before moving to lower-severity items.
3. Add security headers. Addresses A02 (misconfiguration) and takes under 15 minutes with any framework.
4. Update dependencies. Run npm audit weekly to address A03 (software supply chain failures).
5. Add authentication middleware to every API route that reads or writes user data. This is the single highest-impact fix.

FAQ