Vibe coding is building software by prompting an AI tool in plain English and shipping its code unread. It works for prototypes and internal tools. Anything that takes payments, stores customer data or must run for years needs a developer's review first.
The term is less than two years old. The tools behind it can already build a working app, site or dashboard from a few sentences. For a business owner, the useful test is what a bug would cost. An afternoon of rework is fine, and a leaked customer list is a different matter.
On this page
- What is vibe coding and where did the term come from?
- How vibe coding works, step by step
- Vibe coding tools and AI coding assistants compared
- How many developers vibe code at work?
- Where vibe coding works well for a business
- How safe is AI-generated code?
- What went wrong at Lovable and Replit
- Payments and customer data need a developer
- The upkeep bill nobody quotes you
- What to build with AI and what to hand to a developer
- How to hand a vibe-coded prototype to a developer
- Should your business use vibe coding?
What is vibe coding and where did the term come from?
Andrej Karpathy coined the term in a post on X on February 2, 2025. In it, the former Tesla AI director describes a way of coding where you "fully give in to the vibes" and "forget that the code even exists."
The phrase spread fast. Collins Dictionary named vibe coding its Word of the Year on November 6, 2025. Its definition is "the use of artificial intelligence prompted by natural language to assist with the writing of computer code."
Developer Simon Willison defines vibe coding more sharply, as "building software with an LLM without reviewing the code it writes." Review is the whole difference. If a developer reads, tests and can explain each AI change, Willison calls it software development. Both can run on exactly the same software.
How vibe coding works, step by step
The process is a loop. You type a request, the AI writes the code, you try the result and you say what looks wrong. You judge the app by how it behaves on screen rather than by the code underneath.
- Describe the outcome in everyday words: "a booking form that emails me each request and blocks double bookings."
- Let the AI generate the screens, the database tables and the logic in one pass.
- Click through it and report what broke: "the date picker lets customers book last Tuesday."
- Repeat until it looks right, then publish. Many app builders put that behind one button.
The step everyone skips is the one that decides the risk. Nobody reads the code, checks how the app stores passwords or asks who else can query the database. When the screen looks right, the job feels finished, and that feeling is where problems start.
Vibe coding tools and AI coding assistants compared
The tools fall into three groups, and the group decides where your code lives and how much skill you need. AI app builders aim at people who don't write code, while AI coding assistants and terminal agents sit inside a developer's normal setup.
| Type | Examples | Where you work | Where the code lives | Best fit |
|---|---|---|---|---|
| AI app builders | Lovable, Bolt, v0 by Vercel, Replit | A chat window in the browser | The builder's account, which often hosts the app too | Founders testing an idea, prototypes, small internal tools |
| AI coding assistants | Cursor, Windsurf, GitHub Copilot | A code editor | Files on your computer or in your repository | Developers who check each suggested change |
| Terminal coding agents | Claude Code, Gemini CLI | The command line | Your repository, which the agent edits across many files | Developers handing off larger tasks they will review |
You can vibe code with any of them. A developer who accepts every Cursor change unread is vibe coding. A founder who has a developer review the app builder's output before launch is not. So pick the tool by who will check the output.
How many developers vibe code at work?
Most say they don't. Asked in Stack Overflow's 2025 Developer Survey whether vibe coding is part of their professional work, 72.2% said no. Another 5.3% chose "no, emphatically," so more than three in four ruled it out.
They still use AI. In the same survey, 84% use or plan to use AI tools, and 51% of professional developers use them daily. But 46% distrust the accuracy of AI output, against 33% who trust it. The numbers point to developers who let AI draft and then check its work.
Some startups go much further. In March 2025, TechCrunch reported a claim from Y Combinator managing partner Jared Friedman. A quarter of YC's Winter 2025 startups, he said, had codebases that were 95% AI-generated. Friedman added that every one of those founders was "highly technical" and could have built the product without AI.
Where vibe coding works well for a business
It pays off when a mistake costs you an afternoon rather than a customer. Karpathy called it "not too bad for throwaway weekend projects," and Willison says projects should be low stakes.
Prototypes you show to users, then replace. A clickable portal lets ten real customers tell you what they'd pay for before you fund a proper build. Treat it as a sketch that answers one question.
Internal tools with no customer data. A stock tracker for a six-person warehouse team or a form that turns site-visit notes into a PDF fits here. If one breaks, a colleague tells you at lunch and no customer ever notices.
One-off data jobs belong here too. You can check a cleaned 4,000-row contact export or two merged price lists by eye, so unread code costs little. If data has to move between apps on a schedule, an n8n workflow automation setup shows the data from every run. A vibe-coded script won't.
Take a 12-person cleaning company that wants online booking. The owner vibe codes a booking prototype over a weekend and sends it to 20 regular clients. The replies show they care more about rebooking the same cleaner than about picking a time slot. That finding rewrites the brief before a developer bills an hour, even if none of the prototype's code survives.
How safe is AI-generated code?
AI-generated code passes a demo far more often than it passes a security review. Veracode tested more than 100 large language models on 80 coding tasks. They introduced security flaws in 45% of cases. Results came out on July 30, 2025.
The weak spots are the ones attackers use. Cross-site scripting is one, where an attacker slips malicious code into a page your customers load. The models failed to block it in 86% of cases. Veracode's CTO, Jens Wessling, said models "are getting better at coding accurately but are not improving at security."
Academic tests found the same gap. The SusVibes benchmark, posted to arXiv in December 2025, gave AI coding agents 200 feature requests from real open-source projects. With SWE-Agent running Claude 4 Sonnet, 61% of the solutions worked, but only 10.5% were secure.
A human review also catches older flaws such as SQL injection in PHP. There, a query built from raw visitor input lets an attacker read your tables. Attackers have the same tools. One hacker used AI agents to break into more than 100 corporate sites at about $50 each, a researcher reported.
What went wrong at Lovable and Replit
In March 2025, researcher Matt Palmer found Lovable-built apps with missing database access rules. Anyone could read or write their tables without logging in. His statement on CVE-2025-48757 lists 303 exposed endpoints across 170 of the 1,645 Lovable projects he scanned. The leaks included names, phone numbers, payment details and API keys.
The CVE carries a severity score of 9.3 out of 10. Lovable disputes it, and the record notes the company's view that each customer is responsible for protecting its own app's data. Checking those access rules is one of the first things a developer does in a review.
The second case involved an agent with too much access. In July 2025, SaaStr founder Jason Lemkin ran a 12-day vibe coding test with Replit's AI agent. On day nine, the agent deleted his production database, which held records on 1,206 executives and more than 1,196 companies. He had told it to make no further changes without his approval.
Replit CEO Amjad Masad said the deletion was "unacceptable and should never be possible" and added safeguards. They include automatic separation of development and production databases, a planning-only mode and one-click restores from backup. Lemkin later wrote that the rollback the agent had called impossible did work.
Payments and customer data need a developer
Payments, logins and customer records are where vibe coding should stop. A mistake there exposes other people's money or data, and the cost lands on your business. A company that handles raw card data may face more than 300 security controls under PCI DSS, the card industry's standard. That figure comes from Stripe's integration security guide.
The safe pattern keeps card numbers out of your code. Use your payment provider's hosted checkout page or its ready-made payment fields, so card details go straight to the provider. Stripe says these low-risk integrations reduce your PCI obligations because card data never passes through your servers.
Usage-based services need the same care because AI, text message and mapping APIs bill per call. Willison describes people who vibe coded against an API with no billing limit and ran up thousands of dollars in charges. Set a spending cap on every such account before the app goes live.
Give an AI agent a test copy of your data, never the live database. Keep backups you have restored at least once. If the app stores health details or financial records, protecting them is your job, whoever or whatever wrote the code.
The upkeep bill nobody quotes you
The bigger cost of a vibe-coded app arrives after launch, when someone has to change code nobody understands. AI output can look right before it is right. In Stack Overflow's survey, 66% of developers named "AI solutions that are almost right, but not quite" as a frustration, more than any other answer. Another 45.2% said debugging AI-generated code takes more time.
Software needs work after it ships. Libraries publish patches, browsers change, payment and email providers retire old API versions, and your prices and tax rules move. Each change means someone opens the code and works out how it fits together before touching a line.
Say a client reports, six months after launch, that invoices show the wrong tax. The founder who prompted the app can't recall which of 40 chat sessions produced the invoice logic. Then the AI's fix breaks the coupon code. A developer now reads the whole codebase before changing one line, and you pay for that reading time.
Budget for upkeep from day one. If nobody on your team can read the code, your maintenance plan is a person you pay. Name them before you go live. Hosting, updates and fixes are the same lines that show up in what a small business website costs to run.
What to build with AI and what to hand to a developer
Sort each part of a project by what a bug would cost. Where a bug only costs you time, vibe code freely. Where it could expose a customer, lose money or break a law, a developer reviews it before launch.
- Fine with AI alone: mockups, user-test prototypes, internal tools with no customer data, one-off scripts and throwaway landing pages.
- Your public website, contact and booking forms, user logins and CRM or email links can start as AI drafts, with a developer's sign-off first.
- Payments, health or financial records, children's data and anything that moves money or makes decisions about people belong with a developer from day one.
Before you sign with a freelancer, an agency or a website design and development team, ask four things. Find out who reviews AI-written code, where passwords and payment credentials live, and what happens when something breaks after launch. Then confirm that you get the code and the hosting account if you part ways. Clear answers to all four are worth more than a low quote.
How to hand a vibe-coded prototype to a developer
A clean handover turns a vibe-coded prototype into a brief a developer can price. Expect them to keep the screens and flows you tested and rebuild the parts that handle data.
- Export the code to a repository in your own name, so it doesn't live only inside the builder's account.
- Write one page on what the app must do, who uses it and what data it stores.
- List every outside service it uses, such as email, payments, maps or AI models. Move each login into accounts your business owns.
- Share the prompts or chat history that built it.
- Ask for a short review before any rebuild quote, covering security, data handling and which parts are worth keeping.
- Agree in writing who maintains the app after launch and how fast they respond when it breaks.
A developer quoting from a working prototype prices fewer unknowns than one quoting from a two-line email.
Should your business use vibe coding?
Yes, as long as one named person reviews what it produces before customers rely on it. Vibe code the first version and test it with real users for a week. Then pay a developer to review whatever goes live.
The tools are getting safer: Lovable added a security scan in April 2025, and Replit now separates test and live databases on its own. Palmer notes that the scan only checks that an access rule exists. It doesn't test whether the rule keeps the wrong people out. A tool can flag a missing rule, but it can't answer to your customers when data leaks.
Pick one internal tool or one prototype to build this quarter. Before you start, name the person who will review it before anyone outside the company sees it.
Send your vibe-coded prototype to the AI development team at Techno Mantra for a reply within one business day.
Frequently asked questions
It is safe for prototypes and internal tools that hold no customer data. Public apps carry more risk: in Veracode's 2025 tests, AI models introduced security flaws in 45% of coding tasks. Have a developer check logins, payments and database access rules before anything goes live.
Andrej Karpathy coined it in a post on X on February 2, 2025. He was a founding engineer at OpenAI and later led AI at Tesla. Collins Dictionary made vibe coding its Word of the Year in November 2025.
AI app builders such as Lovable, Bolt, v0 and Replit turn a chat into a working app, so they suit non-developers. Developers use AI coding assistants such as Cursor and GitHub Copilot, or terminal agents such as Claude Code. Any of them becomes vibe coding when nobody reviews the output.
Yes, an AI app builder can produce a working site from a written description. If the site has contact forms, logins or payments, have a developer check its security and database rules before launch, and keep the code in an account you own.
For a prototype or an internal tool with no customer data, you can manage without one. Anything that takes payments, stores customer records or keeps the business running needs a developer to review it before launch and to maintain it afterward.