AI is making everyone web app builders - but leaving teams exposed | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

AI is making everyone web app builders - but leaving teams exposed

The security gap emerging as AI makes app building easier

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

You know a concept has gone mainstream when Collins Dictionary names it Word of the Year. Lo and behold, that’s what happened with “vibe coding” in 2025. For those who missed it, the official definition is “emerging software development that turns natural language into computer code using AI.”

This recognition won’t have come as a surprise to those familiar with AI-assisted software development. It has completely revolutionized how and who builds the websites and web applications we use on a daily basis.

Development was historically reserved for specialist teams. Now, key lines of code are being created by people who likely don’t know their pointers from their Python. In other words, people who would never have been in that role before.

AI code security risk: The need for a smarter layer between detection and remediation

Beyond the hype: The critical role of security in responsible AI development

Vibe coding works best when we treat it like a 3D printer – you read that right

From a purely innovative perspective, it’s exciting. It lowers the barriers to this technology and allows new perspectives and ideas. But it also extends the gap between how websites or web applications are generated - and more importantly, how they are run safely, particularly when exposed to real users on the web.

For a long time, the hard part wasn’t simply getting products to work, but ensuring code is secure and can be maintained once it’s gone live. This problem is compounded in today’s landscape, with software flipping from promising to a security nightmare in seconds.

How do we know when (and why) this happens? We have to look under the coding hood. By identifying what's actually changed in building, we can start to understand what the environment around it needs to do differently.

AI coding tools are now part of the mainstream web development workflow. Stack Overflow found that 84% of developers are either currently using or planning to use AI tools in their development process.

In the hands of experienced developers, this can result in faster iterations, freeing up time to be spent on high value items. Output soars, while waste is minimized. For less technical users, it can ensure websites go from ideation stage to actually being built - again, we have “vibe coding” to thank for this.

All that’s required is a short text description, and suddenly they’re met with functional sites at their fingertips.

No one is doubting the impressive nature of these results. However, functionality does not mean readiness.

Testing AI is not like testing software and most companies haven't figured that out yet

If everyone is rushing to board the AI ship why are so few workflows secure?

A website or web application can appear complete on the surface. But peel back the layers, and you’ll often find it lacks the protections, controls, and architecture needed in the real world.

It’s hardly a secret that R&D leaders are yet to be convinced about the integrity of AI-generated code, with 75% reporting concerns around security and data privacy risks.

The situation isn’t helped by wave after wave of younger people entering businesses, muddling their way through AI tool usage without a CS background, a mentor, or a clear picture of the risks. For this generation especially, the gap between what works and what’s secure is even more crucial.

AI-generated sites can connect to third-party services while mishandling credentials. These might expose sensitive info in their raw code, like source files or client-side scripts.

Look at Moltbook, the social media site for AI agents, which exposed the private data of over 6,000 users tied to its developer, using AI-developed code to create the website.

Meanwhile, data sensitivity concerns are only growing at the enterprise level. And as questions mount over how public cloud providers use data for AI training, larger organizations are moving workloads off-cloud entirely, with their decision to revert back to bare metal or private infrastructure only creating more risk.

So, the pace of improvement in the tooling doesn't yet match the pace at which new builders are deploying to production. The question is: is there a solution?

As AI expands the existing pool of web building, it opens up a new role for hosting - taking on broader responsibility, past simply being just the place where a product sits. It’s now becoming part of the environment that ensures websites and web applications are deployed securely and operated confidently.

The hosting layer can be a much-needed control point, especially as more AI-generated sites are pushed online while lacking traditional review processes.

An integrated model can build in features like web application firewalls, security infrastructure, performance tooling, and protection against common attacks, all acting as baseline functions.

This is incredibly important for non-specialists and small teams, who may not have a dedicated security engineer (or even a second developer) to review work.

And the benefits extend to support, too. One reality of AI-assisted development is that the product might not just be insecure, but also fragile or incomplete in a way that builders don’t understand.

If something breaks, hosting providers can play an active role by not just creating infrastructure, but helping customers deploy what they create securely.

If you're a small team deployed on a major cloud provider with no meaningful spend, there's effectively nobody to call when something breaks. Hosting providers can fill that gap. Not just with infrastructure, but with human-backed support that helps builders understand what went wrong and how to fix it.

As development, deployment, and security become more closely connected, hosting platforms can absorb more of the operational burden.

More experimentation. More entrepreneurship. More innovation. The excitement surrounding AI, and the doors that it opens, is palpable. But before we get carried away, we need to address the elephant in the coding room: security must be baked into the process.

Accountability shouldn’t disappear simply because AI generated the code. Human oversight still matters, along with code reviews, testing, and security checks. Similarly, the emergence of a new era doesn’t warrant doing away with the basics of software security. Secrets must be stored properly.

Dependencies must be checked. Access controls should be enforced, API should be protected.

New models of implementation can help ensure these elements are factored in at every stage. And it’s those who can build safely, operate confidently, and support the people doing it along the way that will have really cracked the code.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

1 It's Memorial Day and Flexi Spot has slashed its prices by up to 80%

2 What is the release date for Dutton Ranch episode 4 on Paramount+?

3 The Terra Mow V1000 robot lawn mower is the perfect wire-free lawnbot for newbies and technophobes

4 Surfshark has dropped an exclusive deal for Tech Radar readers just in time for Memorial Day 2026 — here's how to claim your free Amazon gift card worth up to $30

5 From split-tunneling to post-quantum crypto: Nym VPN just had its biggest two-month update yet, and a fresh redesign is already on the way

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards