LLMs should know that, for maybe a CRUD app, there should be taken care of security at various layers, i.e. input validation in controllers. Knowledge from popular frameworks that communicate security boundaries should be transferable for them, even if everything is custom code. Very confusing to me how they manage to completely ignore so much of it. I guess they are too good following suit of a productivity minded vibe coder.