What Is Vibe Coding? And Why Does It Create Security Risks?
Vibe coding is a term coined by AI researcher Andrej Karpathy in early 2025 to describe the practice of building software by describing what you want to an AI — and letting the AI write the code. Instead of understanding every line, you iterate by feel: describe a feature, review the result, tweak the prompt, ship. It has enabled a generation of non-technical and semi-technical founders to build and launch real products.
Where the Term Comes From
Andrej Karpathy (former Tesla AI director and OpenAI co-founder) coined 'vibe coding' to describe his own experience using AI coding tools to build projects by feel rather than by traditional software engineering discipline. The term spread quickly because it named something millions of people were already doing with tools like Cursor, Claude, Lovable, Bolt, and Replit.
The Tools That Enable Vibe Coding
The major vibe coding tools as of 2025: Cursor (AI-powered IDE for developers), Claude Code (Anthropic's terminal coding agent), Lovable.dev (generate full-stack apps from a prompt), Bolt.new by StackBlitz (browser-based AI app builder), v0 by Vercel (UI component generation), Replit (AI-assisted cloud IDE), GitHub Copilot (in-editor AI completions), and Windsurf by Codeium (AI IDE similar to Cursor). Each generates working code at a speed no traditional developer team can match.
Why Vibe Coding Has Taken Off
Vibe coding has dramatically lowered the barrier to building software. A non-technical founder can go from idea to deployed app in a weekend. A solo developer can build features in hours that previously took weeks. Startup costs that previously required a development team of 5 can now be achieved by one person with an AI. This is genuinely transformative — and it has unleashed a wave of new products that would never have existed otherwise.
The Security Problem With Vibe Coding
AI coding tools optimize for generating code that works. They do not have your specific threat model, business logic constraints, or compliance requirements in context. They produce plausible, functional code that routinely has authentication bypasses, hardcoded secrets, SQL injection vectors, broken payment logic, and missing authorization checks. These bugs are invisible during happy-path testing because the app works fine — they only surface when an adversarial user deliberately exploits them.
What This Means for Founders
Vibe coding is not inherently dangerous — it is a tool that needs the right process around it. Just as you would not ship a financial product without an accountant's review, you should not ship a vibe-coded app with real users and real data without a professional code audit. The audit is the quality gate that AI tools cannot provide for themselves.
What VibeAudits Does
VibeAudits specializes in auditing apps built with AI coding tools. We understand the specific failure patterns of Cursor, Lovable, Bolt, Claude, and Replit — because we have audited dozens of apps built with each. Our process finds the security issues, architecture problems, and reliability risks that vibe-coded apps consistently produce — and delivers a prioritized fix list so you can ship with confidence.