Guide · Updated July 25, 2026

What is vibe coding?

Vibe coding is the practice of building software by describing what you want in plain language to an AI model — and shipping what it writes back — instead of hand-writing every line. The name was popularised in early 2025 by researcher Andrej Karpathy, who described letting an LLM drive the keyboard while he "fully gave in to the vibes." The term stuck because it captures how a growing number of people actually ship products now.

Vibe coding meaning, in one line

Vibe coding means the developer sets the intent (features, look, behaviour), the AI writes the code, and the human's job shifts from typing to reviewing, steering, and gluing pieces together.

What vibe coding looks like in practice

• You describe a feature ("add a pricing page with three tiers and a Stripe checkout button").
• The AI writes the routes, components, database migrations, and API calls.
• You skim the diff, run the preview, and ask for changes in more plain English.
• You keep iterating until the app matches the vibe you had in your head.

Tools like Lovable, Cursor, v0, Bolt, and Replit Agent all lean into this workflow. So do the millions of side projects being shipped by founders, designers, and product managers who never wrote production code before.

Why vibe coding took off

• Speed. An idea can be a working URL in an afternoon.
• Access. You don't need to know React, SQL, or auth patterns to ship something real.
• Iteration. Changing the whole layout is a sentence, not a refactor.
• Fun. The feedback loop is short enough to feel like play.

The security catch nobody mentions

The AI is optimised to make your feature work, not to make it safe. It has no memory of the threat model of your app and no incentive to say "hold on, this endpoint has no auth." Reviewing "does it work?" is easy. Reviewing "is it secure?" is a different skill — and the one vibe coders most often skip.

The same handful of issues show up in almost every vibe-coded app we scan:

• Service-role or admin API keys pasted into frontend code.
• Database tables reachable from the browser because row-level security was never turned on.
• "Protected" routes that check for a token on the client but not on the server.
• File uploads that accept anything and expose it at a public URL.
• Missing security headers — no CSP, no HSTS, no X-Frame-Options.
• Sourcemaps and .env-style files served in production.

None of these require a nation-state attacker. A curious visitor with the browser devtools open is enough.

How to vibe code without shipping a breach

• Ask the AI to explain where auth is enforced, not just that it is.
• Keep secrets on the server. If a key starts with sk_, service_, or admin_, it does not belong in the browser.
• Turn on row-level security the moment you create a table.
• Run a vulnerability scan after every meaningful change — not just before launch.
• Feed the scanner's fix prompts back to your AI. It will patch what it wrote.

Vibe coding is here to stay

The productivity gain is too large to walk back. The realistic path forward isn't to stop vibe coding — it's to pair it with the safety net that traditional teams built up over years: automated review, dependency scanning, and vulnerability scans on every deploy. The AI handles the code. Something else has to handle the risk.