This talk was recorded at NDC Oslo in Oslo, Norway. #ndcoslo #ndcconferences #developer #softwaredeveloper
Attend the next NDC conference near you:
https://ndcconferences.com
https://ndcoslo.com/
Subscribe to our YouTube channel and learn every day:
/ @NDC
Follow our Social Media!
https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences/
#copilot #chatgpt #claude #code #vibecoding #ai #sql #functionalprogramming #programminglanguages
Developers use Copilot, ChatGPT, and Claude to write code fast. Accept what compiles, ship what works, that's vibe coding and it's everywhere. And it produces the same categories of vulnerable code, over and over, because AI tools optimize for "runs without errors," not "resists attack."
This talk is three live demos and a workflow. We look at real AI-generated code that looks fine, then pull on the thread. Auth logic with a subtle JWT flaw. Input validation that checks format but misses encoding tricks, leaving the SQL query injectable. Password hashing with real libraries — wrong algorithm, wrong config. Each demo ends with an exploit and a fix.
The patterns aren't random. They're predictable: training data includes all the bad code that's ever been written, models don't know that 2012 crypto advice is outdated, and "compiles and runs" is not the same bar as "secure." Once you know what to look for, you can spot it fast and so can attackers.
You'll leave with a checklist for reviewing AI-generated code (auth edge cases, parameterization vs. validation, crypto choices, secret storage), updated mental models for where AI output needs extra scrutiny, and a workflow that lets your team keep the speed benefits without dropping the security bar.