Secure Coding: Balancing Creativity and Security

👋 Introduction

If you’ve been anywhere near a computer or phone and have even a passing interest in programming, you’ve probably heard the term “vibe coding” popping up all over the internet lately. The act itself isn’t new—nerds and scrappy would-be devs have been winging it since the latest wave of AI tools exploded in popularity. But the official term “vibe coding” was actually formalized in February 2025. It’s been a fascinating social phenomenon to watch (and be a part of).

That said, I’ve started noticing a trend across blog posts, social media, and Reddit threads: vibe coders are getting hacked, or having their apps abused or destabilized—often because they shipped code live without hardening it, or left sensitive stuff in public repos. Love it or hate it, the whole vibe coding craze is both hilarious and inspiring. But I think a lot of devs could benefit from learning how to vibe code without sacrificing security.

"Vibe coding" refers to a style of software development where users, often without formal coding knowledge, describe their desired software functionality to an AI, which then generates the code, and the user accepts the output without necessarily understanding the underlying code. - Google Gemini

1️⃣ Start Small, Start Local

Security is something every coder has a responsibility to take seriously. But let’s be real—it can feel like a giant PITA, especially when you’re deep in the flow and vibe coding.

The good news? Once you build a few security habits into your workflow, it stops feeling like a drag. It becomes second nature—and before you know it, you’re back to moving fast and shipping safely.

Here are a few small wins you can implement right away to help keep your apps more secure, without killing your vibe.

🛠️ Always Use a Separate Dev Environment

One trend I’ve already seen cause problems is live-coding.
Honestly, I think this is a terrible idea no matter how you spin it.

🎥 Live vs. Recorded Coding

Live-coding: Risk of accidentally leaking secrets in real time.

Recorded sessions: Gives you time to blur/edit credentials or regenerate them before sharing.

Pro tip: Always pre-record if you’re using any real credentials—even in dev.

🔐 Why Secure Local Environments Matter

A secure local environment gives you a safe space to build, break, and iterate without exposing your production stack to risk.

Traditional local setups usually include:

🧪 A local web server
🗃️ A database (like SQLite, Postgres, or MySQL)
⚡ A cache (like Redis)
📁 A file system for uploads and downloads

But if you’re using cloud-based resources (like managed databases, file storage, or APIs), you may not have that full local stack. In that case:

⚠️ Never expose secrets.
If you accidentally do, immediately:

Revoke the credentials

Generate new ones

Update your app’s config files or environment variables

🚧 Isolate Your Environments

Whatever your dev setup is, make sure it’s completely separate from production.

Use a multi-phase deployment strategy like:

local/dev → staging → production

This helps ensure that even if your dev or staging environment gets compromised, your production environment stays secure.

2️⃣ Use Git and Version Control Correctly

If you’re a vibe coder—or a new coder in general—and you’re not using Git yet, you should be. Git helps you:

📝 Track changes to your code
🤝 Collaborate with other developers
🧠 Maintain your sanity as projects grow more complex

Without version control, scaling or managing your apps becomes nearly impossible.

🧹 Git Housekeeping Basics

As soon as you create a new repo, make sure it includes a .gitignore file.
This file tells Git which files and folders to exclude from version control—like:

.env files
local build artifacts
log files
node_modules, bin/, obj/, etc.

If you're building an open-source (i.e. public) project and accidentally commit a config file with secrets inside it, your app is now compromised.

⚠️ Even if you delete that file later, the secrets are still in your Git history.

If this happens:

Immediately rotate the leaked keys or credentials.
Add the file to your .gitignore.
Consider using BFG Repo-Cleaner or git filter-repo to scrub the history if needed.

🔐 Extra Protection for Sensitive Info

If you're using tools like Docker, manage your secrets with:

.env files (never commit them)
Docker Secrets (for more advanced setups)

And if you want to go further, use tools like:

git-secrets – scans for sensitive patterns before commit
Git Hooks – run scripts before commits/pushes to catch mistakes

3️⃣ Protect Your Apps with Cloudflare

One of the more easily overlooked parts of building an app is taking advantage of powerful tools that help you manage your domain—and protect it.

I (along with a huge chunk of developers and companies) use Cloudflare to manage DNS. It’s more than just DNS though—you get DDoS protection, bot filtering, caching, and more baked right in.

When you’re vibe coding—especially if you’re live streaming or posting about it publicly—you’re naturally painting a target on your back. More attention means more chances someone (or something) will poke around your app.

🧨 If you’re using something like Cloud Functions that auto-scale with traffic, a flood of bot requests could rack up real costs for literally nothing.

💡 What Does Cloudflare Actually Do?

Cloudflare is a global network that improves performance, security, and reliability by acting as a reverse proxy. It:

Caches your content
Hides your app’s real IP address
Blocks malicious traffic
Helps handle spikes in traffic without melting your backend

🛡️ Security Features You Should Be Using

“Under Attack” Mode – Forces visitors to complete a CAPTCHA before hitting your app.
Yes, CAPTCHAs are annoying, but so is getting spammed by a botnet.
Rate Limiting – Prevent brute-force or denial-of-wallet attacks by throttling traffic per IP.
Firewall Rules – Block or challenge specific traffic patterns (like blocking traffic from a region, or only allowing your IP to access admin routes).

🔒 Bonus: Free SSL + IP Protection

When you register your domain with Cloudflare, they usually include free SSL certificates for both the root domain and the www subdomain. SSLs can be pricey and a pain to configure, so this is a huge plus—especially for smaller projects.

And because Cloudflare proxies traffic, your server’s origin IP stays hidden, adding another layer of protection against direct attacks.

4️⃣ Learn About Auth — But Don’t Roll Your Own

When I first started developing, I was using PHP. Like most languages, it has built-in support for password hashing and creating your own login flow from scratch. And yeah, it was a cool learning experience at the time.

But in this day and age? There’s almost no reason to do that anymore—especially if you’re vibe coding a project.

Most companies today use third-party services to handle authentication. So there’s absolutely no shame in doing the same. In fact, it’s smarter. Just remind yourself:

🧠 You’re not building an auth company. You’re building your own app.
You just need a secure, reliable way for users to log in.

That’s where fully managed auth providers come in. Tools like:

These services make it ridiculously easy to implement secure login flows—and they come with powerful admin tools and features you’d never have the time (or motivation) to build yourself.

✋ Seriously, Don’t Reinvent Auth

I’m not going super deep on this because, honestly, it’s simple:

Tons of devs have tried to roll their own auth.
Most have failed or regretted it.
You don’t need to be one of them.

Just plug in a hosted auth provider, focus on your app’s functionality, and move on.

5️⃣ Take Advantage of Easy-to-Use Serverless Infrastructure

I can’t say enough about this topic—seriously. I recently went down the rabbit hole of moving all my apps off of traditional VMs and onto full serverless infrastructure. The result? Better security. Faster development. Smoother deployments. Less time tied to a computer outside of work. E.g. I can maybe get a life for once. 🥳

🧰 What Is Serverless, Anyway?

Think of serverless infrastructure as the hosting version of managed services like Firebase Auth—but for your backend and deployment pipeline.

For example, I moved from DigitalOcean Droplets running Docker VMs to using DigitalOcean’s App Platform, and here’s what I got out of the box:

✅ SSL by default – No more cert headaches
🔁 Automated deployments from your main branch – Full CI/CD baked in
🚀 Insanely fast iterations – Push, test, and move on

I can’t overstate how powerful this is—especially for vibe coders, indie hackers, and tinkerers who just want to build cool stuff without managing servers like it’s 2012.

⚠️ Reminder: VMs Are Still Servers

If you’re not convinced yet, go check out my other post on “How to Deploy an ASP.NET Core 6 App Using Nginx on Ubuntu 20.04.” It’s a great walkthrough—but also a reminder of just how involved managing a VM can be.

A VM is basically a virtual computer. That means:

You’re on the hook for OS updates
You have to install and renew SSL certs
You’re managing firewall rules, patches, and everything else

With serverless, all that overhead disappears. You pay a small monthly fee, and your cloud provider handles the rest—maintenance, scaling, patching, certs, the whole deal.

💡 Why It Matters for Security (and Sanity)

Just like with managed auth, serverless platforms are built and secured by teams of professional engineers who spend every day making sure things don’t catch fire. You? You get to focus on building your app.

🧠 Pro Tip: Let the experts manage infrastructure. You just ship cool stuff.

💸 Want to Try DigitalOcean?

If you’re curious, you can use my DigitalOcean referral link and you get $200 in free credits to play around with and I get $25 as a thank you from DO. I use DO for all my side projects and tinkering, and here’s why:

Transparent, predictable pricing
No AWS-level bill shock
Great for hobbyists and small-scale projects

Click the link above or on the DigitalOcean badge below to get started on your own awesome side projects, and help me out in the process!

6️⃣ Be (a Little) Paranoid — But Have Fun

If you’ve ever met someone who works in digital security, you’ll know they tend to be a little paranoid—and honestly, that’s a good thing. We need people like that.

But as a vibe coder, your goal should be to find that sweet spot: just paranoid enough to keep your app secure, but not so paranoid that it sucks all the fun out of building.

🧠 Security Starts With Awareness

You don’t need to be a security expert to write safer code. It starts with simple awareness.

Even just thinking about how your code could be abused or misused goes a long way. Make security part of your creative process—not a blocker.

✅ Before You Push or Deploy, Do a Quick Security Sweep:

🔒 Is your Git repo private?
If it’s not meant to be open source, set it to private.
📄 Do you have a solid .gitignore file?
Make sure no config files or secrets are being committed.
🔍 Review your code before pushing
Scan for any hardcoded credentials or sensitive info.
🌐 If you’re building an API:
- Check your CORS policy
- Allow only trusted origins (e.g., your own web app domain)
🛡️ Use your free Cloudflare SSL certs
Cloudflare usually gives you 2 free SSLs—one for your root domain and one for www.
It’s one of the easiest and cheapest ways to secure your app and build trust with users.

📝 Conclusion

Security doesn’t have to be a total PITA. In fact, it can actually be fun to dig into the nuances and learn how to make your apps more secure.

As a vibe coder—or anyone rapidly prototyping—it’s critical to strike a balance between speed and security. That balance becomes even more important when your app starts gaining real traction.

We, as software and tech professionals, have a responsibility to our users. If your app collects or handles real user data, then you are responsible for protecting that data, respecting their privacy, and keeping things safe.

Even if you follow just a few of the tips in this post, your app will instantly become harder to attack. And let’s be real—if you make a would-be hacker work too hard (especially when the data isn’t even that juicy), they’ll probably just move on to someone else’s poorly secured app 👎.

So—keep on vibing (yup, we’re embracing the cringe), throw in some simple security steps, and go build that next big SaaS idea you’ve been dreaming up.

P.S. If you found this post helpful (or at least mildly entertaining), consider hitting that like button and giving me a follow. It helps more than you know!

Want more content like this—plus dev tips, tool recommendations, and maybe the occasional sarcastic take? Sign up for my newsletter to stay in the loop when new posts drop.

As always, thanks for reading. 🙌

~ Cheers 🍻,

How to Vibe Code Without Sacrificing Security

Table of contents