SecureVibe: Making Vibe Coding More Secure
Danqing Wang (CMU), Baolin Peng, Zhepei Wei, Isadora White and colleagues at Microsoft Research with CMU and UVA introduce SecureVibe, a training recipe that targets the planning and testing behaviors that coding agents skip when they produce functionally correct but insecure code.
Ask this paper
Diagnosis. Agents that ship working but insecure solutions are less than half as likely to plan for and test the hidden security risks behind the functional requirements.
Recipe. Supervised fine-tuning on a suite of 4 security tasks, followed by SecureVibe_rl (verifiable execution feedback) and SecureVibe_hg (hint-guided self-supervision).
Security gains. Security pass@1 rises 6.9 points on BaxBench and 11.5 points on SusVibes, including on CWE categories not seen in training.
Functionality also improves. Functional pass@1 rises 13.6 points on SusVibes and 4.1 points on SWE-bench Verified.
Practical findings. Supervision spread across security planning, coding and testing helps more than adding coding trajectories alone, and hints matter most when the agent is too weak at security to learn from outcome reward.
Abstract
As vibe coding becomes increasingly capable and widespread, security vulnerabilities in even functionally correct solutions are a growing concern. When investigating functionally correct but insecure solutions, we find that the insecure agent is less than half as likely to conduct effective planning and testing for the hidden security risks behind the functional requirements. Motivated by this, we develop SECUREVIBE, a training recipe that explicitly targets planning and testing for code security. SECUREVIBE constructs training signals around these security behaviors. It includes supervised fine-tuning on the security suite with 4 security tasks, and post-training methods, SECUREVIBE_rl and SECUREVIBE_hg, to enhance security capabilities from verifiable execution feedback and hint-based self-supervision. Our SECUREVIBE outperforms the baseline on two types of security coding tasks across 4 benchmarks. Specifically, SECUREVIBE improves the security pass@1 by 6.9 points on BaxBench. The gains extend to unseen CWE categories, with improvements of 11.5 points on SusVibes. Meanwhile, it also improves functionality pass@1 by 13.6 points on the security coding task SusVibes and 4.1 points on the generic coding task SWE-bench Verified. Further analysis offers two practical insights: (i) diversifying supervision across security planning, coding, and testing strengthens security behaviors more effectively than adding coding trajectories alone, and (ii) hint-guided supervision is particularly valuable when the agent's existing security capabilities are insufficient to learn effectively from outcome feedback.