We tried “vibe coding” a web app with AI, then checked it against OWASP Top 10 2025.
Even a clean-looking MVP quickly picked up real security issues: SSRF, XSS, insecure defaults, missing logging.
Iterating with AI helped, but didn’t solve everything. See the results of the experiment:
https://softwaremill.com/vibe-coding-against-owasp-top-10-2025/






