Why AI-Generated Code Needs Automated Security Scanning

The Vibe Coding Security Problem

AI coding tools have changed how we build software. Cursor, GitHub Copilot, Bolt, Lovable, Windsurf — they let you ship features in hours instead of days.

But there's a problem nobody talks about enough: AI-generated code has predictable security blind spots.

Table of Contents

1. 1What AI Gets Wrong
2. 2Real-World Examples
3. 3Why Code Reviews Don't Catch It
4. 4The Automated Scanning Solution
5. 5How to Set It Up

What AI Gets Wrong {#what-goes-wrong}

AI coding assistants are trained on public code — which includes a lot of insecure patterns. Here are the most common security issues in AI-generated code:

### 1. Hardcoded Secrets AI tools frequently generate code with placeholder API keys, database passwords, and tokens that look like real values. Developers copy-paste the code and forget to replace them.

// AI generated this "example" — but it looks real enough to ship
const stripe = new Stripe("sk_live_51H7...", { apiVersion: "2024-01-01" });

### 2. Missing Authentication AI generates functional endpoints but often skips authentication middleware. The code *works*, so developers move on.

# AI generated a working endpoint — but forgot auth
@app.post("/api/users/{id}/delete")
async def delete_user(id: str):
    await db.users.delete(id)
    return {"status": "deleted"}

### 3. SQL Injection String interpolation in database queries is one of the most common AI-generated patterns:

# AI used f-strings instead of parameterized queries
query = f"SELECT * FROM users WHERE email = '{email}'"

### 4. Vulnerable Dependencies AI tools suggest packages without checking if they have known vulnerabilities or if they're still maintained.

### 5. Weak Cryptography Using Math.random() for tokens, MD5 for passwords, or custom JWT implementations instead of battle-tested libraries.

Real-World Examples {#examples}

### The Stripe Key Incident A developer used Cursor to build a payment system. The AI generated code with a Stripe test key that looked like sk_test_.... The developer committed it. On the first PR scan with ZeriFlow, the hardcoded key was flagged as critical before it reached production.

### The Unprotected Admin Route An AI agent generated an admin dashboard with full CRUD operations. Every endpoint worked perfectly — but none had authentication. Any user could delete any other user's data.

### The eval() Trap A developer asked their AI to "dynamically execute user-provided formulas." The AI generated code using eval() — a critical security vulnerability that allows arbitrary code execution.

Why Code Reviews Don't Catch It {#reviews}

• Speed: When you're shipping 20 features a day with AI assistance, thorough security reviews become impossible.
• Familiarity bias: If the code was generated by AI and it works, reviewers tend to trust it.
• Knowledge gaps: Not every developer is a security expert. Many of these patterns look perfectly normal to someone focused on functionality.
• AI agents: When AI agents commit code autonomously (50+ commits/day), there's no human reviewer at all.

The Automated Scanning Solution {#solution}

The answer is simple: scan every pull request automatically.

ZeriFlow's CI/CD scanner runs on every PR and catches exactly the issues AI generates:

• Secrets detection — catches hardcoded API keys, tokens, passwords
• Dependency audit — flags packages with known CVEs
• Injection patterns — detects SQL injection, XSS, command injection
• Auth analysis — identifies missing authentication and authorization
• AI false-positive filtering — Claude AI reviews each finding to eliminate noise

The key advantage: it runs automatically. No human needs to remember to check. No security expert needs to review every line. The scanner catches what the AI missed.

How to Set It Up {#setup}

Adding ZeriFlow to your CI/CD pipeline takes 3 minutes:

1. 1Create a ZeriFlow account
2. 2Connect your repository in the CI/CD dashboard
3. 3Add this workflow file to your repo:

name: ZeriFlow Security
on:
  pull_request:
    branches: [main, master]

permissions:
  contents: read
  pull-requests: write

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: Fame29/security-scan@v1
        with:
          api-key: ${{ secrets.ZERIFLOW_API_KEY }}

Every PR now gets a security score. If the score is below your threshold, the merge is blocked.

This is especially critical if you use AI agents that commit code automatically. ZeriFlow becomes the security gate between your AI and production.

Conclusion

AI coding tools are incredible for productivity. But they generate predictable security vulnerabilities that traditional code reviews miss.

Automated security scanning on every PR is not optional anymore — it's essential.

[Set up ZeriFlow CI/CD in 3 minutes →](https://zeriflow.com/ci-cd)