"From Vibe Code to Production: 7 Things AI Won't Do For You"
AI can write your code, but it can't ship your software. Here are 7 critical things AI coding assistants skip — and how to fill the gaps without slowing down.
AI coding assistants are incredible. You describe what you want, and they write working code in seconds. But there's a gap between "code that runs" and "software that ships safely." AI handles the first part. You need to handle the second.
Here are 7 things AI won't do for you — and exactly how to fill each gap.
1. Dependency Security Scanning
What AI skips: AI generates code with whatever dependency versions it learned from training data. It doesn't check if those versions have known vulnerabilities.
Why it matters: 67% of software breaches involve known vulnerabilities in open-source components. If your dependencies are outdated, you're already vulnerable.
The fix:
pip install vulnledger
vulnledger scan .
5 seconds. Checks every dependency against live CVE databases. The scan tells you exactly which packages to upgrade and to what version.
2. SBOM Generation
What AI skips: AI doesn't create a Software Bill of Materials — a structured document listing every component in your project.
Why it matters: The EU Cyber Resilience Act requires SBOMs by 2027. Companies selling software in the EU (450 million people) must provide one. Without an SBOM, you can't comply.
The fix:
vulnledger scan . --json --output sbom.json
One command generates a CycloneDX SBOM. Attach it to your release artifacts for compliance.
3. Input Validation
What AI skips: AI generates code that handles the happy path well but often misses edge cases. SQL injection, XSS, and command injection are common in AI-generated code.
Why it matters: OWASP Top 10 lists injection attacks as the #1 web application security risk. AI doesn't know about OWASP.
The fix:
- Add input validation manually (AI can help you write it — ask specifically)
- Use parameterized queries instead of string concatenation
- Sanitize all user input before rendering or executing
- Add rate limiting to API endpoints
4. Secrets Management
What AI skips: AI frequently generates code with hardcoded API keys, passwords, or tokens. It's pattern-matching from training data that includes tutorials with placeholder credentials.
Why it matters: Hardcoded secrets are the #1 cause of data breaches. GitHub scans for them, but many slip through.
The fix:
- Never hardcode secrets — use environment variables
- Add .env to .gitignore
- Use a secrets manager (AWS Secrets Manager, HashiCorp Vault)
- Run a secrets scanner: pip install detect-secrets && detect-secrets scan
5. Test Coverage
What AI skips: AI generates code but not comprehensive tests. It might add a basic test, but not edge cases, error paths, or integration tests.
Why it matters: Untested code is fragile code. When you update a dependency, you need to know if the update breaks anything.
The fix:
- Ask AI to write tests for specific functions (it's good at this)
- Aim for 70%+ coverage on critical paths
- Add integration tests for API endpoints
- Run tests in CI/CD: pytest --cov
6. CI/CD Pipeline
What AI skips: AI generates application code but not the DevOps infrastructure. No GitHub Actions, no deployment pipeline, no monitoring.
Why it matters: Without CI/CD, every deployment is manual and error-prone. Without monitoring, you won't know when things break.
The fix:
# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: pip install -r requirements.txt
- run: pytest --cov
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: pip install vulnledger
- run: vulnledger scan . --ci
7. Documentation
What AI skips: AI generates code but not documentation. No README updates, no API docs, no architecture decisions recorded.
Why it matters: Undocumented code is unmaintainable. When you come back in 6 months, you won't remember why you made certain choices.
The fix:
- Update README after generating code
- Document API endpoints (OpenAPI/Swagger)
- Record architectural decisions (ADRs)
- Add inline comments for non-obvious logic
The Pattern
AI is great at the "what" — generating code that does something. You need to handle the "how" — making sure that code is secure, tested, documented, and deployable.
The good news: most of these gaps can be automated. The security scan takes 5 seconds. The CI/CD pipeline is one YAML file. Tests can be generated by AI if you ask specifically.
Your workflow should be:
1. Generate code with AI
2. Scan dependencies with VulnLedger
3. Test with pytest/npm test
4. Automate with CI/CD
5. Document what you built
6. Deploy with confidence
The first 4 steps take 10 minutes. The last 2 take 30 minutes. That's 40 minutes to go from "AI wrote this" to "this is production-ready."
What AI Is Actually Good At
Don't get me wrong — AI coding assistants are transformative. They're incredible at:
- Generating boilerplate code
- Writing functions from descriptions
- Explaining existing code
- Refactoring and optimizing
- Writing tests (when asked)
- Suggesting fixes for errors
The key is knowing what to ask for. AI is a tool, not a replacement for engineering judgment. Use it for what it's good at, and handle the rest yourself.
Quick Reference: What to Do After AI Generates Code
| Step | Time | Tool |
|---|---|---|
| Scan dependencies | 5 sec | vulnledger scan . |
| Generate SBOM | 5 sec | vulnledger scan . --json |
| Add CI/CD gate | 2 min | Copy YAML to .github/workflows/ |
| Write tests | 10 min | Ask AI to write tests for key functions |
| Update README | 5 min | Document what the code does |
| Add input validation | 15 min | Review AI code for injection risks |
| Check for hardcoded secrets | 2 min | detect-secrets scan |
Total: ~30 minutes to go from vibe code to production-ready.
Quick Wins: Do These First
If you're overwhelmed by 7 items, start with these 3:
1. Scan dependencies (5 seconds) — catches the most common vulnerability
2. Add CI/CD (2 minutes) — prevents future regressions automatically
3. Check for hardcoded secrets (2 minutes) — catches the #1 breach cause
That's 5 minutes of work that dramatically improves your security posture.
The Developer's Vibe Code Checklist
Use this before deploying any AI-generated project:
- [ ] Ran vulnledger scan . and fixed critical/high CVEs
- [ ] Generated SBOM for compliance
- [ ] Added CI/CD pipeline with security gate
- [ ] Wrote tests for critical paths
- [ ] Updated README with setup instructions
- [ ] Reviewed code for hardcoded secrets
- [ ] Added input validation to API endpoints
- [ ] Set up monitoring (error tracking, uptime)
If you can check all 8 boxes, your AI-generated project is production-ready.
Frequently Asked Questions
Q: Isn't this too much work for a side project?
A: For a side project, just do the first 3 items (scan, CI/CD, secrets). That takes 5 minutes and catches 80% of the risk. Full production readiness is for projects that handle user data or money.
Q: Can I automate all of this?
A: Most of it, yes. The security scan, SBOM generation, and CI/CD pipeline are fully automatable. Tests and documentation require some manual work, but AI can help with both.
Q: What if I'm using multiple AI tools (Copilot + Claude + Cursor)?
A: The checklist applies regardless of which AI tools you use. The output is the same: code that needs security scanning, testing, and documentation before it's production-ready.
Q: How often should I re-scan after updating dependencies?
A: Every time. Add vulnledger scan . --ci to your CI/CD pipeline and it runs automatically on every push.
Q: Is this only for Python projects?
A: No. The checklist applies to any language. The tools change (npm audit instead of pip audit, Jest instead of pytest) but the principles are the same.
Conclusion
AI coding assistants are changing how software is built. But the gap between "code that runs" and "code that ships" still requires human engineering judgment. The 7 items above are what AI won't do for you — but all of them can be automated once you set them up.
Start with the easiest one: pip install vulnledger && vulnledger scan .. It takes 5 seconds and catches the most common security issue in AI-generated code.
pip install vulnledger
vulnledger scan .
Then build from there. The goal isn't to stop using AI — it's to use it responsibly.