A security radar specifically for vibe-coded apps is a genuinely needed tool. The interesting meta-question is whether the patterns of vulnerabilities in AI-generated code are systematically different from human-written code — and early evidence suggests they are. AI tends to over-trust inputs, under-implement authorization checks, and generate plausible-looking but insecure patterns when it lacks specific context about the threat model.
The dashboard approach of tracking security cost over time is the right framing. It's not that vibe coding is inherently insecure — it's that security requires explicit intent and domain knowledge that isn't automatically encoded in "build me an app" prompts. The AI optimizes for functionality, not security.
The Agile Vibe Coding Manifesto addresses this in its principle that "automation must remain verifiable" — specifically arguing that AI-generated systems need explicit security review checkpoints, not just functional testing. The manifesto treats security as an accountability concern, not just a technical one: if humans are accountable for the systems they ship, that accountability extends to the security properties.
Useful project for teams trying to quantify what they're accepting when they ship vibe-coded features: https://agilevibecoding.org
