Vibe Coding for Production
Exercises

Security improvements

Use your agent to review a deliberately vulnerable API, prioritize findings, and fix a few with verification.

Goal

Use the agent to find credible security issues (injection, broken access control, secret handling, open redirects, verbose errors) and fix a subset with care. The exercise pairs well with a secure-by-default mindset: minimize trust of model output, validate, and re-read every diff for dangerous "fixes".

Getting started

The repository ships an intentionally vulnerable .NET API. Run it locally only.

dotnet run

The app starts on http://localhost:5137 with the default launch profile. Open SecurityDemo.App.http in your editor for ready-to-send requests, or hit endpoints with curl:

curl http://localhost:5137/api/users
curl "http://localhost:5137/api/users/search?q=admin"
curl "http://localhost:5137/api/login/continue?returnUrl=https://example.com"

Do not deploy this app. It contains SQL injection, IDOR, an open redirect, and other holes on purpose. Run it on your own machine only.

Workflow

Baseline the stack: tell your agent that this is an ASP.NET Core minimal API on .NET 10, SQLite in-memory, no auth wired up, a deliberately broken teaching sample.
Ask for a threat model in five bullets: assets, entry points, trust boundaries. Keep it short.
Request a prioritized list of issues with: file path, why it matters, and remediation complexity (S/M/L).

Pick one or two high-value items and have the agent implement a fix:

  • parameterized queries instead of string concatenation,
  • replacing verbose exception responses with safe client errors and server-side logging,
  • validating redirect targets against an allow-list.

Broken access control needs a larger fix: add authentication first, then enforce resource-based authorization against that authenticated identity. An ownership check without a trusted identity does not fix the IDOR.

Review every line the agent changes. Security regressions like "disable auth for tests" left in prod are not acceptable.
Re-run the review prompt until the agent reports no critical or high issues, or only items you can justify as false positives.

Non-negotiables

  • Do not paste API keys, connection strings, or PATs into the agent. Use redacted samples or placeholders (***).
  • Do not run exploit code against systems you do not own or do not have written permission to test.
  • If the model suggests disabling CSRF, JWT validation, or HTTPS, treat that as a teaching moment and refuse unless the exercise is explicitly in a lab with no network exposure.

Done when

You have a short written summary: issues found, fixes applied with PR-sized diffs, and one process improvement (dependency audit cadence, SAST in CI, pre-commit secret scan) you would add next.

See also

Secure execution

Configuration patterns to keep secrets out of agent context.

Launching a security review

Prompt patterns that pair with this exercise.

Performance improvements

Measure first, then use your agent to find and fix real performance issues in a small API.

Secure execution lockdown

Configure deny rules and sandbox protections for secret paths while normal code stays readable.

On this page

GoalGetting startedWorkflowNon-negotiablesDone whenSee also