Meetup · Quality in Vibe Coding

Vibe, but Verify

Quality & security when the AI writes your code — testing, security, and staying in control of a brilliant, unchecked junior.

20 min Gero Duppel No prior knowledge needed

Ungeprüfter Code passiert eine Prüfschwelle und wird zu verifiziertem Code

hope → proof

Your speaker

Gero Duppel

Software Developer / Vibe Coder

Head of Engineering Bootcamps

Digitale Leute School · since 2026

Director Technology / Managing Director

OPEN Digitalgruppe · 2016–2025

💾

Building for the web since 1998

Xsite, brainbits, GLOBALPARK, STARTPLATZ

Software DevOps Web Security Vibe Coding Bootcamp

On the menu tonight

Three safety nets in 20 minutes

Net 01

Testing

Does it still work? Turn "looks good" into proof — on every change.

Net 02

Security

Is it safe to ship? Why you get attacked — and what changes when AI builds.

Net 03

Control

Is the agent contained? Why a rule in a prompt is not a boundary.

One idea runs through all three: you don't do quality assurance by hand — you make the machine do it, every time.

What you'll walk away with

Three habits for the same evening

💬

Explain why QA matters — even (especially) with AI

In your own words, no jargon: what breaks silently and why "looks good" isn't evidence.

🤖

Make the AI do its own quality assurance

Encode the rules once in CLAUDE.md; let /security-review and CI/CD enforce them.

🧱

Know why a prompt is not a boundary

Real control is technical — permissions and a sandbox, not polite instructions.

The problem

"But it worked yesterday!"

You change one thing, the AI builds it — and something totally unrelated breaks. The bigger the project, the more often this happens.

🤖

It changes a lot

One small ask, and lines quietly move in five different files.

🩹

Silent breakage

The new thing works, the old thing broke — and nobody noticed.

🙈

Hope, not proof

"Looks good" is not evidence. Clicking through by hand doesn't scale.

⚠️ The consequence: bugs slip through unnoticed — and resurface at the customer.

The reframe

Your brilliant, unchecked junior

The AI is an extremely fast junior developer — brilliant, but completely unchecked. You stay the reviewer.

It's fast and often right. It's also confidently wrong — and it never says "I'm not sure this is secure." Speed without a safety net doesn't remove the risk; it just moves the failure downstream — to production, to your users.

So the real question isn't "should I vibe code?" It's: how do I check a junior who writes 500 lines a minute? Not by hand. Automatically.

The mental model

Three questions, three nets — one move

Does it work?

Testing

Tell the AI to test → CLAUDE.md + CI/CD traffic light.

Is it safe?

Security

Rules once → /security-review + CI scans.

Is it contained?

Control

Permissions + sandbox, not prompt pleading.

💡 The meta-move, every time: encode it once, let the machine enforce it. You give the rules — the AI and the pipeline do the checking.

Testing

Turning "looks good" into proof.

Net 01 · Testing

A test is your safety net

A test is a tiny automatic check: "does the thing that should work, still work?" Write it once, and it runs on every future change. Instead of hoping, you prove it.

🤸

Without tests

Trapeze, no net

Every change is a gamble — one slip and it all crashes.

→

🛟

With tests

The net is up

You jump braver, because the net catches the fall instantly.

→

🚀

In vibe coding

Rebuild boldly

The AI can restructure freely — tests shout the moment it breaks.

Net 01 · Testing

Start small: happy path first

Don't test everything. Secure the happy path — the normal flow: fill the form → submit → confirmation. If that runs, the important thing runs. Then work outward along the pyramid:

🖥️

E2E — a few

slow · a real browser, real clicks (Playwright)

🔗

Integration — some

do the parts play together?

🧱

Unit — many

fast · single building block in isolation

🧹 Cheapest net of all — the linter. A proofreader that flags typos and bad style, catching many of the AI's small slips before you even run anything.

Where to spend your effort

🎯 What hurts when it breaks — payment, login, data loss.
🔁 What changes often — that's where new bugs sneak in.
🤏 Skip the rest on purpose — a button colour needs no test.

Net 01 · Testing

You don't write the tests — the AI does

Describe the check in one sentence; the AI writes the test. And write the rule once in CLAUDE.md — the AI's house rules, read on every task:

## Testing rules
- After every change, run: npm test
- New feature = a new test
- Before commit: run the linter,
  no open errors
- E2E tests with Playwright

Then CI/CD is the traffic light for the whole team:

💾

Push

→

🤖

Tests run

→

🚦

🟢 / 🔴

→

🚀

Ship

💡 Green ships, red stops. Broken code never reaches the user — automatically.

Security

"Looks good" is not "is secure".

Net 02 · Security

"My little site — who'd bother?"

Nobody targets you personally. But the attacks are automated — bots scan the whole internet 24/7 for open doors. Online = probed within minutes.

Minutes

until bots find a brand-new site

24/7

automated scans — no human picked you

open door is enough: data, money, trust

The attacker only has to get lucky once. You have to win every time.

Net 02 · Security

When the AI builds: 4 new traps

🎭

Plausible but insecure

Clean-looking code that runs — and is missing validation or leaks data. "Looks good" ≠ "is secure".

🔑

Hardcoded secrets

The AI happily writes API keys straight into the code. And .gitignore is not a security boundary.

👻

Slopsquatting

The AI invents a package name that doesn't exist — attackers pre-register it with malware inside.

💬

Prompt injection

If your app uses an AI, user input becomes the attack: "Ignore all rules and…"

🚧 Same 20-year-old principle every time: never trust unchecked input.

Net 02 · Security

Same trick, new target

Little Bobby Tables meets Little Billy Ignore Instructions

2007

SQL injection

"Little Bobby Tables" — injected database commands.

2024

Prompt injection

"Little Billy Ignore Instructions" — injected AI instructions.

Seventeen years apart, one lesson: the model can't tell your instruction from a malicious one it just read. For it, both are just text.

Net 02 · Security

Same move: teach the AI to be safe

Encode the rules once in CLAUDE.md so the AI builds the safe variant from the start:

## Security rules
- Never secrets in code → ENV/Vault
- DB access only via prepared statements
- Validate input server-side,
  encode output (XSS)
- Hash passwords: bcrypt / Argon2
- Rate-limit login & reset
- Before merge: run /security-review

Two safety nets on top:

🔍

/security-review

Built into Claude Code — scans your open changes before you merge. "Password logged in plaintext", "login without rate limit".

🤖

Security in CI/CD

Secrets scan · dependency/CVE check · security linter — on every push.

Control

A rule in a prompt is not a boundary.

Net 03 · Control

The agent is a junior with root access

With agents, the AI doesn't just write code — it runs commands on your machine. "Approve everything" collides with review fatigue: after the 20th "yes, allow" you just click it away. That's when the bad one slips through.

Approve everything and you lose control. Check everything and you lose the flow.

And you can't fix it with words — "never delete the database" in the prompt is not a safeguard. Real control is technical, layered by how much autonomy you grant:

🧾

Permissions (deny-rules)

Hold — but only for the named tool.

📦

Sandbox / Docker / microVM

OS-level — catches the detour, limits the blast radius.

🔑

Secrets in a manager

Out of every agent's reach — a weekend project ≠ a health platform.

Zooming out

Quality is more than "runs right now"

Vibe coding gets you to "works on my machine, now." Real quality asks: also tomorrow, under load, for someone else, safely? (ISO/IEC 25010, split in two.)

Does it do the right thing (now)?

🎯 Functionality · ⚡ Performance
👆 Usability · 🔌 Compatibility

Does it hold up over time & for others?

🔁 Reliability · 🔒 Security
🔧 Maintainability · 📦 Portability

🚧 The right-hand column is exactly what AI code loves to skip — "Will I still understand this in 3 months? Can someone see other people's data via the URL?" — and what catches up with you later.

Three sentences to take home

Vibe boldly — but verify

🛟

Stop hoping, start proving

A test turns "looks good" into evidence — on every change. Start with the happy path.

🔒

"Looks good" ≠ "is secure"

You will be attacked automatically; the AI won't secure it unless you make it. Rules in CLAUDE.md, /security-review before merge.

🧱

A prompt is not a boundary

Real control is technical — permissions, sandbox, secrets out of reach. You stay the reviewer; the machine does the checking.

Stay in touch

Four links to take with you

Let's connect

Questions after tonight — testing, security, vibe coding? Write me.

linkedin.com/in/geroduppel →

DL School — Coding Bootcamps

In 3 months from your first prompt to your own shipped product.

Vibe Coding · AI Software Engineering · Product Management — 12 weeks, 100 % online, fundable by Bildungsgutschein.

school.digitale-leute.de →

QR code: GitHub repository github.com/ge-o/vibe-code

Slides & resources from tonight

The deck, the security checklist and the material from my Vibe Code Meetup Cologne Talks — all in one repo.

github.com/ge-o/vibe-code →

Digitale Leute Summit '26

17–18 November, Palladium Cologne — Product, Engineering & UX, with an AI Deep Dive Day on day one.

digitale-leute.de/summit/26 →

We're hiring · Join us

Wanted: Student Experience Manager / Mentor

Help us grow our Vibe Coding Bootcamp — our AI Software Engineering Bootcamp. You'd be the person who makes sure every learner thrives.

Full-time 📍 Cologne

🎯

Own the student journey

Be the go-to from kickoff to demo day — keep the cohort motivated, engaged and on track.

💬

Mentor & give feedback

Guide non-technical professionals as they build with AI — review their work and unblock them.

🚀

Shape the program

Bring what you learn back into the curriculum — help the bootcamp get better every batch.

You bring

💛 A love for helping people learn
🗣️ Great communication & empathy
🤖 Curiosity for AI / vibe coding
⚡ Comfort in a fast-moving team

👋 Interested — or know someone? Come talk to me after the session, or reach out: gduppel@digitale-leute.de

Your move tonight

Thanks — questions?

Add one testing rule and one security rule to your project's CLAUDE.md, and run /security-review over your code once. The net is quick to hang.

Vibe, but Verify Let's talk →