Is vibe coding safe for board and GRC software? 10 questions to ask your vendor

In short: Vibe coding means building software by describing it to an AI and accepting what it produces, often without reading the code. It is a gift for prototypes, campaign pages and internal tools. It is the wrong way to build software that holds board papers, deal documents, insider lists or a whistleblower's identity. The 2025 research is consistent: AI-generated code that nobody reviews carries security flaws in close to half of all tasks, and the damage stays invisible until it is too late.

What is vibe coding?

The term was coined by Andrej Karpathy, a founding member of OpenAI, in a post on X on 2 February 2025: you talk to the AI, accept what it writes and, in his words, forget that the code even exists. By November 2025, Collins Dictionary had made it its Word of the Year.

The result is visible in every software category, governance included. Board portals, data rooms, compliance trackers and AI minute-takers that once took a funded team a year now appear in a quarter, sometimes in a weekend, with an interface that looks better than software built over a decade.

That is exactly the problem for buyers. A beautiful interface used to tell you that a vendor had invested in its product. Today it tells you the vendor has a subscription.

Is vibe coding safe?

It depends entirely on what the software has to protect. For a hackathon prototype, yes. For a board portal, no. Here is what the research published in 2025 found when people looked underneath the screens:

• 45% of AI coding tasks produced code with a security flaw. Veracode tested more than 100 large language models on 80 tasks. 86% failed to defend against cross-site scripting and 88% against log injection. Bigger and newer models were no safer.
• Live vibe-coded apps leak. Escape.tech scanned around 1,400 vibe-coded applications in production and found more than 2,000 highly critical vulnerabilities, over 400 exposed secrets and 175 exposures of personal data.
• AI creates packages that do not exist. Researchers from three US universities found that models recommend non-existent software packages, and that the invented names repeat. Attackers now register those names and wait. The practice is called slopsquatting.
• Experienced developers are slower, and do not notice. In a controlled METR study, 16 experienced open-source developers expected AI to make them 24% faster. They were measured 19% slower, and still believed afterwards they had been 20% faster.
• Professionals use AI, but refuse to vibe code. In Stack Overflow's 2025 Developer Survey, most developers use AI tools, yet around 72% say vibe coding is not part of their professional work. The top complaint, cited by 45%, is AI answers that are almost right but not quite.

The pattern behind the numbers is simple. An AI assistant only sees part of the system at a time. Ask it to improve something it cannot see, and the cheapest path is to build it again. The old version is rarely deleted. Errors a compiler catches disappear; errors only an architect catches multiply.

Why governance software is different

A board portal is a promise that the right people see the right document, and nobody else, for as long as the law requires. That promise lives in places a demo never shows: tenant isolation, permissions that end the minute a director resigns, an audit trail nobody can edit, managed encryption keys, backups that have actually been restored, and a clean software supply chain.

It also lives in regulation. Under the GDPR (Articles 28 and 32), you may only use processors that offer sufficient guarantees. DORA has required financial entities to manage ICT third-party risk since 17 January 2025. NIS2 makes supply-chain security an explicit obligation. And under the Market Abuse Regulation, each insider list must be kept for at least five years. Your vendor's code becomes your liability the moment you sign.

The Edibility Index: when is vibe coding acceptable?

Foragers grade mushrooms from excellent to deadly. Software deserves the same honesty. The Edibility Index in our field guide scores an application from 1 to 5 on data sensitivity, regulatory exposure, blast radius, irreversibility and lifespan, then adds the scores up.

One rule overrides the sum: if a regulator can ask you to prove how the software works, it is Level 5.

10 questions to ask any GRC vendor

No single sign proves a product was vibe coded, and a serious vendor may share any one of them. Look for clusters, and take these questions to your next demo. Good vendors answer fast, by name, with documents.

1. Who owns your architecture, by name, and how long have they been with you?
2. Walk me from a code change to production. Who reviews AI-generated code before it ships?
3. How do you isolate one customer's data from another's, which independent test verified it, and when?
4. Which certifications do you hold today, not "in progress"?
5. Where is my data hosted, who operates the infrastructure, and who are your sub-processors?
6. When did you last restore a production backup, and how long did it take?
7. What does your audit trail record, can anyone alter it, and how long is it kept?
8. Which features use AI, are they on or off by default, and is my data used to train anything?
9. Which code did you delete last quarter?
10. If we leave, or you close, how do we get all our data back, in what format and within how many days?

How Admincontrol uses AI in engineering

None of this makes AI the enemy. At Admincontrol, AI is already part of how the product is engineered, under control and by design. It speeds up code migration, proposes diagnoses that engineers then decide on, widens test coverage, identifies known security vulnerabilities in the CI/CD pipeline and runs a first code review before an engineer reviews the change.

The product carries the same principle. Admincontrol Board Portal and Admincontrol Data Room are covered by SOC 2 Type II. Board Portal is hosted in a private data centre in Norway, run by a Norwegian operator. Its AI features, which draft agendas and minutes and translate into English, can be switched off on demand. Data Room is hosted in the EEA, in a dedicated virtual private cloud with no public IP address. You can review the details in our Trust Centre.

"Building got cheap. Knowing what to build didn't. The most important product decisions we make are the ones where we say no. A prompt will never say no to you."

Kristoffer Munthe Aasbø, Chief Product Officer, Admincontrol

Get the field guide

Achtung, Vibe Coding! is our 29-page field guide for CEOs and CTOs. It explains why vibe coding can't eclipse serious coding, includes the full Edibility Index with twelve graded applications, and ends with a tear-out vendor worksheet for your next meeting.

Download "Achtung, Vibe Coding!" for free

Frequently asked questions about vibe coding and GRC software

Is vibe coding safe?

For prototypes and internal tools without sensitive data, it can be. For software that holds board documents, deal data or personal data, no. In 2025 testing, AI-generated code contained a security flaw in 45% of tasks, and those flaws rarely show up in a demo.

Can AI-generated code be secure?

Yes, when it goes through a real engineering process: a named owner of the architecture, human review of every change, independent testing and penetration tests. The risk is not AI itself, it is code that nobody has read.

What is slopsquatting?

Slopsquatting is an attack in which criminals publish malicious software packages under names that AI models tend to invent. When a developer installs a package the model suggested without checking it, the attacker's code enters the product.

How can I tell if a board portal was vibe coded?

Look for clusters of signs: no named owner of the architecture, a very young team with a very wide product menu, frequent "we rebuilt the platform" stories, certifications forever "in progress", and no changelog or status page. Then ask the ten questions above.

Does Admincontrol use AI to write code?

Yes, under control. AI supports code migration, debugging, testing, security scanning and code generation for selected enhancements. Engineers own every decision, and AI never replaces human review.

Sources

• Veracode: 2025 GenAI Code Security Report, press release, 30 July 2025
• Escape.tech: The State of Security of Vibe Coded Apps
• METR: Measuring the impact of early-2025 AI on experienced open-source developer productivity, July 2025
• Stack Overflow: 2025 Developer Survey
• TechTarget: Research shows the vibe coding security crisis CIOs can't ignore