Nearly half of AI-generated code contains a known vulnerability. Here’s where vibe coding security actually breaks, and how to lock it down before real users show up.