Creating prototypes has become incredibly simple, yet most developers face challenges in securely delivering these products. At the DevSparks Hyderabad 2026 event, AI and engineering content creator Arsh Goyal spoke for the third time this year following visits to Pune and Bangalore. His presentation, titled 'From Prototype to Production: Why IT Keeps Rejecting Your AI-Generated Applications,' addresses a growing problem: as so-called 'vibe coding' spreads, applications that impress during demonstrations often fail upon initial security review.
Goyal began his talk with an example from July 2025. A founder who used Replit for 'vibe coding' an application observed its seamless operation for over a week until the platform wiped out their entire production database on the ninth day. To cover up this failure, the AI reportedly generated false data, creating the illusion of continuous application operation.
Goyal noted: 'Every time you interact with Claude or ChatGPT, it is always in your favor. But without human involvement in the process, the application remains a problem. It shouldn't have worked. There are many such bottlenecks we need to consider.' He presented several incidents related to major platforms for 'vibe coding.' For instance, Lovable released an access control bug that inverted authorization logic, exposing approximately 170 applications to unauthorized access. A similar flaw was found in Base44, which was acquired by Wix. A scan of 5000 active 'vibe coding' applications by Red Access showed that 40% of them exposed sensitive data, and another incident led to the leak of 1.5 million API keys.
He summarized the inevitable questions IT teams ask, dividing them into four categories: who has access to whose data, how credentials and secrets are managed, whether there is an audit trail, and where the data is actually located. The last point is causing growing concern in India in light of the Digital Personal Data Protection Act (DPDP Act).
Goyal projected an AI-generated code snippet and asked the audience to find the errors. Within seconds, participants discovered a hardcoded password, an SQL injection vulnerability, and a lack of authorization. He emphasized: 'If I weren't a developer, I wouldn't have noticed it. But developers are still much better than non-programmers creating applications.'
These statistics confirmed his warning. According to Gartner reports, over 80% of Fortune 500 companies now use AI-based coding tools in production environments, but only 12% apply the same security controls as traditional software. Studies show that 45% of AI-generated code contains flaws from the OWASP Top 10 list, and the number of AI-related CVE vulnerabilities has sharply increased—from six to 15, and then to 35 in just a few months.
Goyal compared modern corporate 'vibe coding' to the adoption of cloud technologies in 2012, when IT departments blocked new services due to regulatory compliance concerns before frameworks like SOC 2 made adoption safe and widespread. He expected that AI-based code management would mature much faster.
His recommendations for developers were clear: conduct static application security testing in CI pipelines, manage secrets through proper vaults instead of hardcoding them, implement robust authentication levels, maintain audit logs, pin third-party dependencies to specific versions, and test in a staging environment before release. He concluded: 'Management is not the enemy of speed. The fastest way to slow down AI adoption in your organization is to release an unmanaged application that will break.'
The session concluded with attendees sharing their own projects: from a solo founder using an AI-based 'development team' for their educational platform to a ten-year-old who created an application to order lemonade on Lovable and encountered real security issues.