How to vibe code securely (without getting hacked)

In this video, Aron Eidelman talks Martin Omander through how to dramatically increase the safety of any code you write with the help of AI coding agents. If you have been "vibe coding" but worry about security vulnerabilities, buggy implementations, or untrusted code execution, this breakdown is for you. *Key takeaways & topics covered* The duo breaks down the shift from blind prompting to setting rigorous rules of engagement for AI sidekicks. Here is what we cover in this episode: * The Strict TDD loop: Learn how to force AI agents into a rigid red-green-refactor loop. This prevents the AI from modifying tests to fit a flawed implementation. * Context engineering: Discover how to use .gemini files to set developer persona, style guides, and OWASP requirements. This automatically enforces strict input validation and parameterized SQL queries by default. * Secure code execution: Contrast raw Docker direct kernel access with gVisor sandboxed syscalls. This allows developers to safely run untrusted, AI-generated code without risking host machine takeover. * Multi-layered defense: Balance least privilege, manual confirmation, and agent supply chain security. This establishes robust fail-safes so no single exploit ruins your backend. Chapters: 0:00 - Intro 1:16 - Small batches 3:36 - Context engineering 5:01 - Access control and sandboxing 6:21 - External verification 8:22 - Takeaways 🔗 Resources mentioned: * DORA article about pervasive security → https://goo.gle/45D7WhR * DORA 2025 report → https://goo.gle/4fLryoM Watch more Serverless Expeditions → https://goo.gle/ServerlessExpeditions 🔔 Subscribe to Google Cloud Tech → https://goo.gle/GoogleCloudTech #ServerlessExpeditions #GoogleCloud Speakers: Martin Omander, Aron Eidelman Products Mentioned: Gemini, DORA Research Project