The Relevance of Software Engineering, Secure coding in Web Applications and the Dangers of Vibe Coding
Introduction
Web applications have become an important part of modern society. Today, people use web applications for online banking, education, healthcare, communication, shopping and business operations. These applications make it possible to access services and exchange information through the internet without necessarily installing software on a computer.
However, as the use of web applications increases, so do the security threats and technical challenges associated with them. Poorly developed applications can expose users to cyberattacks, data breaches, financial losses and system failures. This makes software engineering and secure coding essential practices in modern web application development.
Software engineering provides developers with organized methods for planning, designing, developing, testing and maintaining applications. Secure coding ensures that applications are developed with security in mind to protect users, systems and sensitive information.
Recently, Artificial Intelligence (AI) coding tools have introduced a development approach commonly known as vibe coding. Although these tools make programming faster and more accessible, depending entirely on AI-generated code without proper understanding, testing and security reviews can introduce serious risks.
This article examines the relevance of software engineering and secure coding in web applications, explains the dangers of vibe coding and discusses why proper software development practices should not be ignored. Understanding Software Engineering
Software engineering is the systematic application of engineering principles, methods and techniques to the development, operation, testing and maintenance of software systems.
Unlike simply writing code to make a program work, software engineering involves a structured process that ensures software is reliable, efficient, secure, maintainable and capable of meeting users' requirements.
Some important principles of software engineering include:
• Planning: Identifying the purpose, requirements and resources needed before development begins.
• Modularity: Dividing an application into smaller components that can be developed and maintained independently.
• Documentation: Recording how the application works, including its design, requirements and technical processes.
• Testing: Checking that the application works correctly and identifying errors before deployment.
• Maintainability: Designing software so that developers can easily update, improve and repair it.
• Security: Protecting the application against unauthorized access, attacks and data loss.
One important concept in software engineering is the Software Development Life Cycle (SDLC). It provides a structured approach to building software. The main stages include:
- Requirements analysis: Understanding what users need from the application.
- System design: Planning the structure, database, interfaces and technologies.
- Implementation: Writing the actual program code.
- Testing: Identifying and correcting errors and vulnerabilities.
- Deployment: Making the application available to users.
- Maintenance: Updating the application, fixing problems and improving performance. Following these stages helps developers produce applications that are more reliable and easier to manage.
- Understanding Web Applications A web application is a software program that runs through a web browser and communicates with a web server over a network, usually the internet. Examples include online banking platforms, social media websites, student management systems, hospital management systems and e-commerce platforms. Most web applications consist of three major components: Frontend The frontend is the part of the application that users interact with. It includes buttons, forms, menus, images and other visual elements. Common frontend technologies include HTML, CSS and JavaScript. Backend The backend handles the internal operations of the application. It processes user requests, performs calculations, manages authentication and communicates with databases. Technologies used for backend development include Python, PHP, Java, JavaScript (Node.js) and other programming languages. Database A database stores and organizes information used by the application. For example, a hospital web application may store patient records, medical appointments and staff information. Popular database management systems include MySQL, MariaDB, PostgreSQL and Microsoft SQL Server. These components work together to provide users with the services they need. For example, when a student logs into an online school portal, the frontend collects the login information, the backend processes the request, and the database helps verify the student's account. If any of these components is poorly designed or secured, the entire application may become vulnerable.
- The Relevance of Software Engineering in Web Applications Software engineering plays a major role in ensuring that web applications meet their intended purpose and operate effectively. I. Improved software quality Software engineering encourages proper planning, coding standards and testing. These practices help reduce programming errors and ensure that applications perform their expected functions. II. Better security Security should be considered throughout the development process rather than added after an application has been completed. Software engineering encourages developers to identify possible threats during system design and implement appropriate security controls. III. Easier maintenance Web applications require regular updates to correct errors, introduce new features and respond to changing user requirements. Proper documentation and organized code make maintenance easier. IV. Improved performance and reliability Proper system design helps developers manage resources, database operations and server requests efficiently. This reduces unnecessary delays and improves the overall user experience. V. Reduced development costs Although planning, testing and documentation require time and resources, they help prevent expensive problems after deployment. Correcting a security vulnerability or major system failure after an application has been released may cost much more than addressing the problem during development. Therefore, software engineering is not simply about writing code. It is about producing software that can solve real-world problems effectively and sustainably.
- The Relevance of Secure Coding in Web Applications Secure coding refers to the practice of writing computer programs in ways that reduce security vulnerabilities and protect applications from malicious activities. It is an essential part of software engineering because web applications often process sensitive information such as usernames, passwords, financial records and personal data. Without proper security measures, attackers may exploit weaknesses in an application to access, modify, steal or destroy information. Some important secure coding practices include: a). Input validation Developers should validate information entered by users before processing it. This helps prevent malicious or unexpected input from being used to attack the application. For example, a registration form should check that email addresses, passwords and other required fields contain valid information. b). Password hashing Passwords should never be stored as plain text in a database. Developers should use secure password-hashing algorithms such as Argon2id, bcrypt or scrypt. Hashing makes it significantly more difficult for attackers to recover original passwords if the database is compromised. c). Authentication and authorization Authentication verifies the identity of a user, while authorization determines what that user is permitted to access. For example, a hospital management system should allow doctors to access authorized patient information while preventing ordinary users from accessing administrative functions. d). Secure database operations Developers should use parameterized queries or prepared statements when communicating with databases. This helps prevent attackers from manipulating database queries through malicious input. e). Data encryption Sensitive information should be protected during transmission using HTTPS and TLS. Appropriate encryption should also be considered for sensitive data stored in databases. f). Regular security testing Applications should undergo regular security assessments to identify weaknesses before attackers discover them. The National Institute of Standards and Technology (NIST), through its Secure Software Development Framework (SSDF), recommends integrating security practices throughout the software development life cycle. This demonstrates that security is not an optional feature but a fundamental requirement of responsible software development.
- Common Security Vulnerabilities in Web Applications The Open Worldwide Application Security Project (OWASP) publishes the OWASP Top 10, which identifies major security risks affecting web applications. Some important vulnerabilities include: 6.1 SQL Injection SQL injection occurs when attackers manipulate database queries by submitting malicious input through application fields. For example, an insecure login form may allow an attacker to manipulate the database query and potentially gain unauthorized access. Prevention: • Use parameterized SQL queries. • Validate user input. • Apply appropriate database permissions. • Avoid constructing SQL queries through unsafe string concatenation. 6.2 Cross-Site Scripting (XSS) Cross-Site Scripting occurs when attackers inject malicious scripts into web pages viewed by other users. For example, an insecure comment section may allow an attacker to submit JavaScript that executes when another user opens the page. Prevention: • Apply proper output encoding. • Sanitize untrusted HTML where necessary. • Use Content Security Policy (CSP). • Avoid inserting untrusted data directly into executable browser contexts. 6.3 Broken Access Control This vulnerability occurs when users can access information or perform actions beyond their authorized permissions. For example, a student may be able to access another student's academic results by changing an identification number in a URL. Prevention: • Implement server-side authorization checks. • Apply role-based access control. • Verify permissions for every sensitive request. • Follow the principle of least privilege. 6.4 Authentication Failures Authentication failures occur when weaknesses in login and identity verification allow attackers to compromise user accounts. Examples include weak passwords, poorly implemented password recovery systems and missing protections against repeated login attempts. Prevention: • Enforce strong password policies. • Implement multi-factor authentication. • Use secure session management. • Apply appropriate login rate limits. 6.5 Security Misconfiguration This occurs when applications, servers or databases are configured insecurely. Examples include default passwords, unnecessary open ports, exposed error messages and publicly accessible sensitive files. Prevention: • Change default credentials. • Disable unnecessary services. • Configure servers securely. • Keep software and dependencies updated. These vulnerabilities demonstrate why secure coding and proper software engineering practices are necessary when developing web applications.
- Understanding Vibe Coding Vibe coding is an emerging software development approach in which developers use natural-language instructions to tell Artificial Intelligence tools what they want to build, allowing the AI to generate much of the program code. Instead of manually writing every line of code, a developer can describe an application to an AI tool and request features, corrections or improvements. Examples of AI-assisted coding tools include ChatGPT, GitHub Copilot and other AI-powered development environments. For example, a person may instruct an AI tool: “Create a hospital management web application with a login page, patient registration form and database connection.” The AI may generate frontend code, backend functionality and database-related instructions. Benefits of vibe coding • It can speed up the development of prototypes. • It makes programming more accessible to beginners. • It can reduce the time required to write repetitive code. • It helps developers explore ideas and generate solutions. • It can assist with debugging and understanding unfamiliar technologies. However, these benefits do not mean that AI-generated code is automatically correct, secure or suitable for production environments.
- Demerits and Dangers of Vibe Coding Although vibe coding can improve development speed, using it without proper software engineering practices introduces several risks. I. Generation of insecure code AI tools can generate code containing security vulnerabilities. For example, an AI-generated login system may store passwords in plain text, use insecure database queries or fail to implement proper access control. If developers deploy such applications without reviewing the code, attackers may exploit these weaknesses. II. Lack of understanding of generated code A major danger occurs when developers use AI-generated code without understanding how it works. When errors occur, they may find it difficult to identify the cause or correct the problem. This creates dependence on AI tools and reduces the developer's ability to solve technical problems independently. III. Hidden programming errors AI-generated code may appear to work correctly during simple demonstrations but fail under different conditions. For example, a student management application may successfully register a few students but fail when several users attempt to access it simultaneously. Without proper testing, these errors may remain unnoticed until deployment. IV. Poor code quality and maintainability AI tools may generate duplicated, unnecessarily complicated or poorly organized code. As the application becomes larger, developers may struggle to understand, update and maintain it. V. Exposure of sensitive information Some developers may unintentionally submit passwords, API keys, database credentials or confidential company information to AI tools. This can create privacy and security risks, particularly when sensitive information is handled without appropriate organizational controls. VI. Overdependence on AI Relying completely on AI for programming can weaken developers' understanding of programming concepts, debugging and problem-solving. AI should support human intelligence rather than replace the technical knowledge and responsibility required of software developers. VII. False confidence An application that looks attractive and works during a short demonstration is not necessarily secure or reliable. A functional interface does not prove that its database, authentication system, backend operations and security controls are correctly implemented. Consequently, developers must never assume that generated code is ready for deployment simply because it appears to work.
- Consequences of Developing Web Applications Without Software Engineering Ignoring software engineering principles can have serious consequences for developers, organizations and users. • System failures: Poor planning and inadequate testing may cause applications to crash, produce incorrect results or become unavailable. • Data breaches: Weak security controls can expose sensitive information to unauthorized individuals. • Data loss: Poor database design, inadequate backups and incorrect data-handling procedures may result in permanent information loss. • High maintenance costs: Poorly structured code makes it difficult and expensive to correct errors or introduce new features. • Poor user experience: Applications with slow response times, confusing interfaces and frequent errors discourage users. • Difficulty upgrading applications: Without proper documentation and organized architecture, developers may struggle to introduce new technologies or modify existing features. For example, consider a hospital management web application developed without proper software engineering. If patient records are not adequately protected, unauthorized users may access confidential medical information. If the database is poorly designed, important patient records may become inconsistent or lost. Such situations can affect the organization's reputation, operations and the privacy of its users.
- Recommendations and Best Practices To develop reliable and secure web applications, developers should combine software engineering principles, secure coding practices and responsible AI usage.
- Follow the SDLC: Use a structured development process that includes requirements analysis, design, implementation, testing, deployment and maintenance.
- Apply secure coding principles: Validate inputs, hash passwords securely, implement authentication and authorization, and protect sensitive information.
- Use AI responsibly: Treat AI-generated code as a suggestion that requires human review, testing and verification.
- Conduct regular security testing: Use appropriate tools and techniques to identify vulnerabilities before applications are released.
- Follow OWASP guidelines: Use the OWASP Top 10 as a starting point for understanding and addressing common web application security risks.
- Follow NIST recommendations: Integrate secure software development practices into the entire development life cycle.
- Maintain proper documentation: Document application requirements, architecture, database structures and important security decisions.
- Use version control: Tools such as Git help developers track changes, collaborate and recover previous versions of their code.
- Protect sensitive information: Never expose passwords, API keys or confidential database credentials in source code or public repositories.
- Keep applications updated: Regularly update frameworks, libraries, dependencies and server software to address known vulnerabilities. Most importantly, developers should understand the code they produce, whether it is written manually or generated with AI assistance.
- ** Conclusion** Software engineering and secure coding are essential to the development of reliable, efficient and secure web applications. Software engineering provides the processes and principles required to build, test and maintain quality software, while secure coding protects applications against cyberattacks and unauthorized access. Although vibe coding and AI-assisted programming offer opportunities to accelerate development and make programming more accessible, they also introduce risks when developers depend on generated code without understanding, reviewing and testing it. Developing a web application should involve more than making its features work or creating an attractive interface. Developers must consider security, performance, reliability, maintainability and the protection of users' information. AI should therefore be treated as a development assistant rather than a replacement for software engineering knowledge and professional responsibility. 12.** References**
- OWASP Foundation. (2025). OWASP Top 10: The Ten Most Critical Web Application Security Risks.
- National Institute of Standards and Technology (NIST). (2022). Secure Software Development Framework (SSDF), SP 800-218.
- MDN Web Docs. Learn Web Development.
- PortSwigger. Web Security Academy.
- Microsoft Research. (2025). Vibe Coding: Programming Through Conversation with Artificial Intelligence.
- IBM. (2025). What Is Vibe Coding?
- Canadian Centre for Cyber Security. (2026). Managing Security Risks in Vibe Coding.
