Vibe Coding Against OWASP Top10 2025

Mon, 22 Dec 2025 11:36:00 +0000
Security, OWASP, Vibe Coding, OWASP Top10

The OWASP Top 10, the reference standard for the most critical web application security risks, has just dropped a new 2025 version - the first major update since 2021. It feels like the perfect moment to ask: how does the rise of vibe coding intersect with these risks? So I built a simple web app with AI and audited it against the new Top 10. The results explain why "ship fast, fix later" could be a dangerous game.

source: https://owasp.org/Top10/2025/

OWASP Top 10 2025

The OWASP Top 10 sums up the most common web app security problems. It is built from a large dataset of real application security findings, grouped by underlying weakness (CWE). Categories are ranked mainly by how often they appear across applications, not by raw counts. Most entries come directly from data, while a couple are added through community surveys.

Let’s start with an important thing - OWASP Top 10 is primarily an awareness document, not a coding or testing standard. It documents AppSec risks with not necessarily easily testable issues - the bare minimum and just a starting point in the AppSec world. If you are looking for the OWASP standard helping adopt application security, you should use ASVS - Application Security Verification Standard. I have recently written some blog posts about implementing OWASP ASVS and what's new in ASVS 5.0 2025 version. I encourage you to check them out.

Currently, we have access to the Top 10 2025 release candidate. However, while the data collection and analysis are finalized, the remaining thing is formatting and editing stuff, so we can treat it as ready in terms of the important knowledge. Here is a brief summary of what has changed in comparison to the 2021 version. You can read the full document, which includes a comprehensive explanation of each point at a dedicated site: https://owasp.org/Top10/2025..

source: https://owasp.org/Top10/2025/0x00_2025-Introduction/

Vibe coding vs OWASP Top 10

The idea is simple: we'll vibe code a web app where there's a lot of potential for making security mistakes from the OWASP Top 10 2025 issues. The aim is to observe how often, especially when we're not paying close attention, we might unknowingly introduce vulnerabilities.

It's essential to note that the goal isn't to prove that AI is unsafe or that vibe coding is inherently bad. Instead, to take a look at what happens in practice, how shifts in discipline and workflow impact the incidence of common web security weaknesses.

We're about to vibe code a personal gallery app for saving your favorite websites. At first glance, it's straightforward - a minimal UI with login, a display of saved links, with extra features like an option to export the gallery. What looks like a harmless side project is actually a perfect playground for potential security pitfalls, each mapping somehow onto the OWASP Top 10. Potential vulnerabilities are:

Operations on user-provided URLs - Accepting URLs for website previews can become vectors for Server-Side Request Forgery (SSRF) or injection attacks if not...