What helps solve it is understanding the code deeply and thinking about it.
It's not perfect, but vibe coding means you don't even get that.
It's not perfect, but vibe coding means you don't even get that.
Vibe-coding actually might be the absolute best way to find vulnerabilities because the AI knows a lot more about them than you or I do, it can pattern-match against known anti-patterns, will do exhaustive searches without flagging halfway through, and is kept up-to-date by its ongoing weight-maintenance about new types of vulnerability.
What you have prompted me to do is add a pass to the 'make a release' script to ask it to search for vulnerabilities and report them, then put any found ones on the TODO list for the next pass.