Rules Files for Safer Vibe Coding

This piece outlines the security risks of AI-assisted programming—especially "vibe coding"—citing studies (e.g., BaxBench) that show elevated vulnerability rates in LLM-generated code. It recommends pairing traditional AppSec practices (SAST, SCA, secrets scanning, shift-left/PR checks) with security-focused rules files for coding assistants (e.g., Copilot, Claude, Cursor, Windsurf) to standardize safer code generation. The report highlights common weaknesses (e.g., CWE-94, CWE-78, CWE-190, CWE-306, CWE-434; language-specific pitfalls) and summarizes research showing that explicit security prompting and security-aware personas significantly reduce vulnerabilities. It concludes by open-sourcing baseline secure rules files and the prompt used to generate them to accelerate adoption.