What is vibe coding? What it’s good for, and what breaks when real users arrive

What is vibe coding?

The term comes from a post by Andrej Karpathy, a founding member of OpenAI, on February 2, 2025: “There’s a new kind of coding I call ‘vibe coding’, where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” He described accepting every change without reading the diffs, and called it “not too bad for throwaway weekend projects”.

The word spread quickly. Collins named it Word of the Year for 2025, defining it as “the use of artificial intelligence prompted by natural language to write computer code”. Merriam-Webster added a full entry in September 2026. Tools such as Lovable, Bolt, Replit and Cursor are built around the idea: you describe the app, and the AI writes and runs it.

Is all AI-assisted coding vibe coding?

No, and the difference matters. The programmer Simon Willison drew the line in March 2025: “If an LLM wrote the code for you, and you then reviewed it, tested it thoroughly and made sure you could explain how it works to someone else that’s not vibe coding, it’s software development.” A year after coining the term, Karpathy wrote that professionals now work “with more oversight and scrutiny”, and that his preferred name for that is “agentic engineering”.

Most professional developers use AI but don’t vibe code. In Stack Overflow’s 2025 Developer Survey of more than 49,000 developers, 84% were using or planning to use AI tools. But 72% said vibe coding was not part of their professional work, and a further 5% said so emphatically.

What is vibe coding good for?

Speed, above all. It is a good fit for:

• Prototypes and demos: showing an idea to users or investors in days rather than months.
• Internal tools that hold no sensitive data and have a handful of trusted users.
• Personal projects and one-off scripts.
• Testing whether anyone wants the thing, before paying to build it properly.

The line is crossed the moment the app holds other people’s data or money. From then on it is not a weekend project, and it needs the checks below.

Is vibe coding safe?

Not by default. Independent research keeps finding that AI-generated code often works and is often insecure, and that the people using it tend to overestimate its quality:

What actually goes wrong in vibe-coded apps?

The documented failures are rarely clever attacks. They are settings nobody checked, and the same few repeat:

Two things stand out. Most of these are access-control mistakes, which a checklist catches. And several happened in the builders themselves, which is a reason to check your own app rather than assume the platform has.

What do the AI app builders say about security?

They are candid about it. Lovable’s documentation says: “You are responsible for ensuring that your app meets the security requirements appropriate for its use case”; its scans “cannot guarantee complete security”; and for sensitive apps it recommends “an additional professional security review.” Replit says its pre-publish checks “complement, rather than replace” a full scan. Bolt calls its publish-time audit “a first pass, not a replacement.”

What should you check before real users arrive?

These catch most of the incidents above. None needs you to read the code line by line:

1. Row-level security is on for every database table, with a policy per operation. Our Supabase RLS checklist shows how to test it.
2. No secret key is in the browser: search the built JavaScript for anything that isn’t meant to be public.
3. Every server endpoint checks who is asking. Hiding a button is not access control.
4. Projects, storage buckets and files are private unless you chose otherwise.
5. Development and production use separate databases, so a test run can’t touch live data.
6. Backups exist, and you have restored one.
7. Payments reconcile: webhooks are verified, and cancellations and refunds update your records.
8. Errors and downtime alert a person.

The longer version is the 20 ways AI-built apps fail in production, and for Lovable specifically, from Lovable demo to production.

When does a vibe-coded app need a professional review?

When it holds personal data, takes payments, or lets users see each other’s information. That is also where Lovable’s own documentation recommends one. The AI-Built App Audit Report is that review: read-only access, a written report ranked by severity in two business days, $349, and the fee is credited against any fix. If the report finds more than you want to fix yourself, the Launch Hardening Sprint fixes it at a fixed price.