Input Validation Vibe Coding: Fix AI-Generated Code Vulnerabilities

Quick answer

Missing input validation is one of the most common security gaps in vibe-coded apps. Fix it by adding server-side validation for all user inputs, using a validation library like Zod or express-validator, and never trusting client-side checks alone. This prevents injections, data corruption, and broken access control.

Why vibe-coded apps skip input validation

When you build an app with AI tools like Cursor, Bolt.new, or v0, the generated code often assumes inputs are safe. AI models are trained on patterns, not security audits. A typical form handler might look clean but lack checks for type, length, and content. That's how a simple string field can become a vector for XSS or SQL injection.

I've seen apps that accept email addresses without validation, pass user IDs directly into database queries, or trust file uploads without verifying MIME types. The cost? Data leaks, account takeover, and hours of debugging after launch.

What to check first

Before diving into fixes, audit your existing code for these signs of missing input validation:

If you're using a free AI app security scanner, it will flag these patterns automatically.

Step-by-step fix: Add server-side validation with Zod

Let's fix a typical vibe-coded Next.js API route that handles user registration. The AI probably generated something like this:

// Before: No input validation
export async function POST(req) {
  const { email, password, name } = await req.json();
  const user = await db.user.create({ data: { email, password, name } });
  return Response.json({ user });
}

This code is vulnerable to injection, malformed data, and missing required fields. Here's how to fix it:

// After: With Zod validation
import { z } from 'zod';

const userSchema = z.object({
  email: z.string().email('Invalid email address'),
  password: z.string().min(8, 'Password must be at least 8 characters'),
  name: z.string().min(1).max(50),
});

export async function POST(req) {
  try {
    const body = await req.json();
    const validated = userSchema.parse(body);
    const user = await db.user.create({ data: validated });
    return Response.json({ user }, { status: 201 });
  } catch (error) {
    if (error instanceof z.ZodError) {
      return Response.json({ errors: error.errors }, { status: 400 });
    }
    return Response.json({ error: 'Internal server error' }, { status: 500 });
  }
}

Why this works: Zod parses and validates the input before any database operation. If validation fails, the API returns a 400 with specific error messages. This prevents malformed data from reaching your database and blocks injection attacks.

Fixing GraphQL inputs

If your vibe-coded app uses GraphQL, add validation in resolvers:

const resolvers = {
  Mutation: {
    createUser: async (_, args) => {
      const schema = z.object({
        email: z.string().email(),
        password: z.string().min(8),
      });
      const validated = schema.parse(args.input);
      return db.user.create({ data: validated });
    },
  },
};

Validating query parameters

URL parameters are also user input. Never trust them directly:

export async function GET(req, { params }) {
  const userId = z.string().uuid().parse(params.id);
  const user = await db.user.findUnique({ where: { id: userId } });
  return Response.json({ user });
}

Common mistakes in vibe-coded apps

How OverMCP helps catch missing validation

Instead of manually auditing every endpoint, use a continuous security monitoring service that scans your code for common vulnerabilities. OverMCP's secret leak scanner also catches exposed API keys that often accompany poorly validated inputs. For vibe-coded apps deployed on Vercel, the Vercel security scanner can automatically check your routes for missing validation.

FAQ

What is input validation in vibe coding?

Input validation is the practice of checking that user-supplied data meets expected formats, types, and constraints before processing it. In vibe-coded apps, this is often missing because AI tools focus on functionality over security.

How do I find missing input validation in my AI-generated code?

Look for API routes that directly use req.body, req.query, or params without any parsing or schema checks. Use a linter with security rules or a free AI app security scanner to automatically detect unvalidated inputs.

Can client-side validation be enough for security?

No. Client-side validation is easily bypassed by disabling JavaScript or sending requests via tools like cURL. Server-side validation is mandatory for security.

---

This guide is part of a series on securing vibe-coded apps. Check out our [security headers checker](https://www.overmcp.com/tools/headers) and [SSL certificate checker](https://www.overmcp.com/tools/ssl) for more ways to harden your deployment.