Vibe Coding Security Risks: This Week's Real Signal

Two things happened at once this week. A team building a refund engine that touches real Stripe webhooks and customer PII watched an intern's AI-coded replacement ship in an afternoon — after they'd spent two months building the same thing carefully. Meanwhile, the platform underneath most of these builds, Vercel, spent the week tightening exactly the things that make an afternoon rewrite risky: long-lived secrets, unbounded agent spend, and who's accountable when the agent acts on its own. Read together, they're the same story.

TL;DR

• A team building a refund engine touching Stripe webhooks and PII had to rebuild its review process after an intern's AI-coded replacement shipped in an afternoon — see the thread.
• Vercel is replacing long-lived personal access tokens with short-lived, auto-rotating ones in GitHub Tools and skills.sh — fewer secrets sitting around for an agent, or an attacker, to find.
• New Vercel legal terms spell out shared responsibility for actions an AI agent takes on your account.
• AI Gateway now lets you cap spend per API key, closing off the looping-agent and leaked-demo-key scenarios that quietly run up bills.

Should AI agents rewrite production code?

The clearest signal this week came from a Reddit post, not a vendor announcement. A team spent two months building a refund approval engine by hand — real Stripe webhooks, real customer PII, tests written on purpose because the stakes were real. Then an intern pointed a coding agent at the same problem and had a working replacement by the end of the afternoon. The poster's takeaway wasn't that the AI version was bad. It was that the demo being fast made the review harder, not easier — because the team's process was built around the pace of careful human work, not around a backend that shows up finished before anyone's had time to ask what it does with a webhook signature or a customer record. Read the full post.

The lesson generalizes past this one team. If your app touches payments, PII, or anything a compliance auditor would care about, the question isn't whether an agent can build it fast. It's whether your review process can keep up with fast.

Vercel is quietly retiring the long-lived secret

Two separate Vercel changes this week point at the same problem: agents need access to things, and every access grant that lives forever is a thing that can leak.

GitHub Tools now mints short-lived, scoped GitHub tokens at runtime instead of asking you to store a personal access token. Vercel's own description is blunt: "there is no secret to store, rotate, or leak." The skills.sh API does the same thing for querying the open-source skills ecosystem — a short-lived, auto-rotated token scoped to your team and project, rate-limited per minute.

This matters because vibe-coded apps accumulate secrets fast. Every integration an AI builder wires up is a credential somewhere, and the fewer of those credentials are long-lived and broadly scoped, the smaller your blast radius when one of them ends up in a commit, a log, or a shared prompt.

Who's responsible when the agent acts alone?

Vercel also updated its Terms of Service and Marketplace terms to address something that didn't exist as a legal category a few years ago: an AI agent, not a human, taking an action on your account. The changelog frames it as a shared-responsibility clarification — for Vercel's own AI features and for third-party agentic tools you've connected.

This is worth reading even if you skip most changelogs. If you've given a coding agent write access to your repo, your deploy pipeline, or your database, the terms governing who's accountable for what that agent does just moved. Know what you agreed to.

Budgets, and the agent that won't stop

The last piece is cost, which is a security problem wearing a finance costume. Vercel's new AI Gateway budgets let you cap spend per API key, aimed squarely at three scenarios every vibe coder will recognize: an autonomous workflow that loops without supervision, a demo that gets shared and catches unexpected traffic, and a developer experimenting without a sense of per-model cost. A spend cap doesn't stop a leaked key from being used — but it stops that use from becoming a five-figure surprise.

FAQ

Should AI agents rewrite production code without human review?

No. Speed is not the same as correctness, especially for code touching payments, webhooks, or personal data. The team in this week's Reddit thread didn't reject their intern's AI-built backend — they rebuilt their review process to match how fast it arrived, checking webhook signature validation, PII handling, and error paths before treating a fast demo as production-ready.

Why does Vercel say there's no secret to leak in GitHub Tools?

Because the new Vercel Connect integration in GitHub Tools mints a short-lived, scoped token at runtime instead of relying on a personal access token you store and rotate manually. There's nothing long-lived sitting in your environment for a leaked log or a compromised dependency to expose.

What happens if my AI agent leaks or loops on an API key?

Until recently, the honest answer was "your bill goes up until you notice." AI Gateway's new per-key budgets cap spend on a given key and reject further requests once the cap is hit — a backstop for looping agents, shared demo links, and leaked keys, not a replacement for rotating the key itself.

The bottom line

Nothing here is a breach. It's a pattern: AI agents are fast enough to outrun the review habits most teams built around human-paced work, and the platforms underneath them — Vercel this week — are responding by shortening the lifespan of secrets, capping what a runaway agent can spend, and writing down who's responsible when the agent, not you, pulls the trigger. If your app touches money, PII, or anything with a webhook, treat a fast AI-built feature the same way that Reddit team eventually did: slow down at review time, even when the build was fast.