What Is Vibe Coding?
Vibe coding is a method of building software where you describe what you want in plain English and an AI tool — Cursor, Lovable, Bolt, Claude, or Copilot — writes most or all of the code. The term was coined by Andrej Karpathy in February 2025.
Vibe coding makes it possible for founders with no coding background to ship working apps in hours or days. It also means shipping a lot of code you didn't write and don't fully understand — which matters a great deal once real users and real money are involved.
The full definition
Vibe coding (also written as "vibecoding") is a style of software development in which a person describes what they want to build in natural language and an AI coding assistant generates the code. The person steers by describing, reviewing, and redirecting, rather than by writing syntax.
The term was coined by Andrej Karpathy — co-founder of OpenAI and former head of AI at Tesla — in a post in February 2025. Karpathy described a way of working where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists."
The practice had been happening for years before the name existed, but the label gave it a shared frame. By 2025, a generation of founders had built and launched real products using AI tools without a background in software engineering.
The fundamental shift: vibe coding separates intent (what you want) from implementation (how the code works). That separation is powerful for speed. It becomes a liability when the app is handling real users, real data, and real payments — because the implementation details the founder didn't write are exactly the ones most likely to contain serious security and reliability problems.
The main vibe coding tools
Each tool takes a different approach. The right one depends on whether you're a developer who wants AI in their existing editor or a founder building from zero without a coding background.
VS Code fork with AI that reads your whole codebase and writes code inline. Best for developers who want fine-grained control.
Build full-stack web apps from a prompt. Generates React + Supabase apps. Ideal for non-technical founders.
Generates complete apps in the browser with a Node.js backend. Good for rapid prototyping with instant preview.
Anthropic's CLI agent that reads, edits, and runs code in your terminal. Used by engineers for complex multi-file changes.
Autocompletes code inline in VS Code and other editors. Best used alongside a human who understands the codebase.
Cloud environment with an AI agent that builds, deploys, and debugs from a chat interface. Good for quick experiments.
Generates React UI components from prompts or screenshots. Best for frontend work integrated into a Next.js project.
AI-first editor from Codeium with a collaborative agent (Cascade) that reasons across your whole codebase.
How vibe coding works in practice
A typical vibe coding session looks like this: you open Cursor, Lovable, or Bolt, describe a feature in a chat box ("add a Stripe checkout that limits each user to one active subscription"), and the tool writes or edits the relevant files. You review the result in the app, describe the next thing, and iterate.
The pace is genuinely different from traditional development. An MVP that would take a solo developer two to four weeks can come together in a few days. For non-technical founders, the tools remove the need to learn a programming language before validating a business idea.
The catch is that AI tools optimise for code that runs and passes the most obvious test. They are not optimising for:
- Security — secrets management, auth flows, access control
- Reliability — error handling, retries, transaction boundaries
- Consistency — the same pattern used the same way everywhere
- Correctness at edge cases — malformed input, concurrent writes, unexpected state
None of those failures are visible in a working demo. They show up when real users hit the app with real data.
Vibe coding risks before launch
These are the patterns that show up repeatedly in professional audits of vibe-coded apps — none of which are visible in a working demo.
API keys, database URLs, and tokens hardcoded in the repo or shipped in client bundles. The most common critical finding in vibe-coded apps.
Sessions without expiry, missing authorization checks, and ID-based access that lets user A read user B's data.
Raw user input piped into queries, file paths, or shell commands. SQL injection and data corruption risks.
Auth, payment, and AI endpoints with no throttling — open to brute force, cost runups, and abuse.
Failed webhooks, dropped payments, and broken jobs that swallow exceptions instead of alerting anyone.
Prompt injection paths, unbounded token spend, and LLM tool calls that execute actions without guardrails.
How to ship a vibe-coded app safely
Build your prototype
Use Cursor, Lovable, Bolt, or Replit to generate your working prototype. Focus on validating the idea, not on perfecting the code.
Test the golden path end to end
Manually walk through every core user flow: sign-up, login, core feature, checkout, and key edge cases. Fix anything broken before moving on.
Run a professional security audit
Have a senior engineer review the AI-generated code for the issues the AI reliably misses: exposed secrets, broken auth, missing validation, rate limiting, payment handling.
Fix all critical and high findings
Address every critical and high-severity finding before you handle real user data, process payments, or announce publicly.
Add monitoring before you launch
Set up error tracking (Sentry, Datadog), structured logging, and alerting. Production issues should reach you before your customers do.
Frequently asked questions
Who coined the term vibe coding?
Andrej Karpathy — co-founder of OpenAI and former head of AI at Tesla — coined the term in a post in February 2025.
Is vibe coding the same as AI coding?
They overlap. AI coding includes any use of AI in the development process (autocomplete, refactoring, test generation). Vibe coding specifically refers to the high-level pattern of describing what you want and letting AI write most or all of the code, often without a traditional development background.
Can non-technical founders use vibe coding to build real products?
Yes, and many do. Lovable, Bolt, and Replit are specifically designed for non-technical builders. The risk is treating the demo as the finished product. A working prototype built with AI still needs a security review before it handles real users and real money.
Is vibe coding just a trend?
No. The underlying pattern — AI generating production code from natural language — is a structural shift. The tools are improving rapidly, the number of founders using them is growing, and the gap between 'can build' and 'technical background' has narrowed dramatically. The security and reliability challenges that come with AI-generated code are not going away.
What does a vibe coding audit cover?
A professional vibe coding audit covers the areas AI tools reliably get wrong: exposed secrets and API keys, authentication and session handling, authorization and access control, input validation and injection, rate limiting, error handling around payments and webhooks, and AI-specific risks like prompt injection and unbounded token spend.