Vibe coding and IAM debt: are your controls keeping up?

TL;DR: Vibe coding lowers the barrier to building software, but it also industrialises over-privileged access, hidden credentials, and orphaned non-human identities, according to P0 Security. The governing issue is no longer code quality alone, but whether generated access paths are bounded tightly enough to survive inevitable mistakes.

NHIMG editorial — based on content published by P0 Security: The identity risks of vibe coding by Neha Duggal

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.

Questions worth separating out

Q: How should security teams govern IAM for vibe-coded applications?

A: Security teams should treat generated IAM as production access logic, not as developer convenience.

Q: Why does vibe coding increase non-human identity risk?

A: Vibe coding increases NHI risk because it creates more service accounts, API keys, and machine roles faster than governance teams can track them.

Q: What is the difference between code review and access review in AI-generated software?

A: Code review checks whether the application works and whether the logic is acceptable.

Practitioner guidance

• Require explicit review of generated IAM policies Route every AI-generated cloud permission block through a security review that checks resource scope, action breadth, and unintended wildcard access before deployment.
• Add secret scanning to pre-commit and CI gates Detect hardcoded API keys, connection strings, and credential-like patterns in generated code before they reach repositories or build pipelines.
• Enforce zero standing privilege for generated workloads Issue short-lived, task-scoped credentials for AI-assisted applications and remove persistent access by default unless a documented exception exists.

With 96% of organisations storing secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, per Ultimate Guide to NHIs, the governance gap is already structural rather than theoretical?

👉 Read P0 Security's analysis of the identity risks of vibe coding →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →