Vibe Coding at Work: Security, Dependencies, PII, Agents, and the Real Risks
In this Off The Wire episode recorded during Cybersecurity Awareness Month, Tanner and Anthony discuss “vibe coding,” defined as using a large language model to generate applications, and why it’s becoming more common in workplace IT. They share examples of replacing a $25,000/year call-analysis tool with LLM-driven results and a quickly built front end, while emphasizing that speed shifts responsibility for security and operations onto the organization. Key risks and practices include managing packages and dependencies, running vulnerability scans and pen tests, avoiding hard-coded secrets by using password managers or identity integrations, and carefully handling PII via local models or zero data retention options alongside clearer policies and stronger DLP. They stress adding authentication, logging, certificates, and encryption, keeping documentation outside the app, limiting agents to read-only and preserving RBAC, avoiding over-reliance on vibe coding for business-critical systems, and communicating risks to leadership.
00:00 Cold open
00:29 What vibe coding is and why small shops want it
02:20 CLIP: Call Analytics Savings
02:41 Replacing a $25K call analytics app
03:27 Why a programming background matters
05:30 Vulnerable dependencies and code that never gets patched
09:02 Hardcoded secrets and identity integration
10:33 PII, zero data retention, and local models
11:45 CLIP: Reportable Line
13:19 The DLP gap at co-ops
14:10 CLIP: Over-Modeling
15:28 Authentication, logging, and certificates
17:27 CLIP: Hammer And Nail
17:27 Sprawl: when everything looks like a nail
18:06 Reverse-engineered software and legal exposure
21:10 CLIP: Docs Not Enough
21:10 Documentation and key-person risk
22:06 AI agents and least privilege
22:48 CLIP: Easy Part
24:47 CLIP: Data House
24:47 Getting your data house in order
26:34 CLIP: Saving Our Bacon
26:37 Security fundamentals still protect you
27:35 CLIP: Responsibility Shift
27:36 Build vs. buy: you own the 3 AM call
29:38 What to tell your team and leadership
29:38 CLIP: Brief Leadership
31:14 Wrap-up
