If you "vibe code" by writing a specification, then
1. either: you write down what is important to get secure code output
2. or: your IDE adds what is important to get secure code output (I don't know the level of prompt magic Cursor / Claude Code / ... add)
3. or: your LLM automatically knows what is important to generate secure code (unlikely)
4. or: you're f..ked
As you typically don't know 2, and 3. is not reliable, if you don't want 4., do 1.