Abstract
<title>Abstract</title> <p>Vibe coding, the habit of letting a language model produce a whole working app from a short prompt, has made shipping software trivial. It has also made shipping insecure software trivial. Models routinely skip the controls a careful engineer would add: a content security policy, a referrer policy, a plan for secrets, checks on who can see what. This paper asks a narrow, measurable question. If you build the same small web app twice from the same prompt, once with no security tooling and once with an automated security-audit agent skill, how much does the result improve? We built two versions of a static e-commerce demo called Northwind. The first, Experiment 1, had no security help. The second, Experiment 1.2, was built with the Vibe App Security Audit skill, a five-step loop that scans, flags, fixes, and re-scans. We scored both with a weighted model of sixteen security controls. The skill cut unmitigated risk from 100 units to 1, a 99.0 percent drop. The Security Posture Score rose from 58 to 99 out of 100. All four high-severity gaps disappeared, and the total number of findings fell from 16 to 1. We provide mathematical proofs for all quantitative claims, including the risk reduction formula, the security posture score calculation, and the CSP effectiveness metric. The V4 improvements add context-aware XSS detection, CSP effectiveness analysis, and payment gateway security scoring. The work suggests that a cheap, built-in audit step changes the baseline of Artificial Intelligence (AI)-generated software more than any single added feature would.</p>