Topic starter
06/06/2026 2:21 am
TL;DR: Vibe coding can generate plausible-looking authentication code, but it routinely misses token expiry handling, CSRF checks, refresh token rotation, and password hashing safeguards, according to WorkOS. The governance lesson is clear: auth is infrastructure with adversarial failure modes, not a place to trust pattern-matched code generation.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Vibe code everything except your auth”.
Key questions
A: The control most likely to fail is the trust boundary, not just the code syntax.
Q: Why is authentication harder to delegate than UI or scripting work?
A: Authentication is harder to delegate because it is a security boundary with adversarial failure modes, not a cosmetic implementation task.
Q: How do security teams know whether generated auth code is actually safe?
A: Teams know it is safe only when they test the control paths that attackers abuse, including token rotation, state validation, CSRF coverage, password handling, and session recovery after expiry.
Practitioner guidance
- Define authentication invariants before generation Document token expiry, refresh behaviour, CSRF coverage, session fixation protection, and password storage requirements before any LLM generates code.
- Review every state-changing auth endpoint Check login, logout, password reset, OAuth callback, and session update paths for CSRF tokens, state parameter validation, and replay resistance.
- Remove password custody from application code Prefer a managed authentication service when the team cannot prove it can own hashing, storage, rotation, and recovery flows continuously.
Bottom line: Authentication code that only appears correct still creates a real security risk when it omits lifecycle and adversarial controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
06/06/2026 3:58 am
Authentication exactness is a control requirement, not a code style preference. This article shows that identity logic fails when teams treat authentication as a feature that can be approximated from examples. The exactness requirement matters because token lifecycles, OAuth state, and session boundaries are security controls with adversarial consequences. The practitioner conclusion is straightforward: auth must be engineered as deterministic infrastructure, not improvisational code.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: When should organisations stop building custom authentication?
A: Organisations should stop building custom authentication when they cannot prove they can own the full lifecycle, including hashing, token management, provider changes, patching, and incident response. At that point, auth is no longer a feature decision. It is a governance decision about whether the team can sustain the control surface it is creating.
👉 Read our full editorial: Vibe coded auth fails because identity needs exactness, not plausibility
This post was modified 12 hours ago by NHI Mgmt Group