Vibe coding is building software by describing what you want to an AI tool in plain English and accepting the code it writes, without reading or understanding that code yourself. You judge the result by whether it seems to work, then ask for changes until it does. The term was coined by the AI researcher Andrej Karpathy in early 2025, and tools such as Lovable, Bolt, Replit and Cursor have made it possible to produce a working-looking app in an afternoon.
It’s a remarkable way to sketch an idea. It’s also a risky way to build software that holds customer data, takes payments or runs part of your business. This guide explains why, and what the alternative looks like.
What is vibe coding?
The idea is in the name: you go with the vibe. You type “build me a booking app for a physiotherapy clinic with online payments”, the tool generates screens, a database and the code joining them together, and you keep prompting until it looks right. You never open the code. If something breaks, you paste the error back in and let the AI try again.
For people who can’t code, that’s genuinely new. A founder can test an idea with real users before spending money on development. A manager can build a small internal tool that would never have made it onto the IT team’s list.
Vibe coding vs AI-assisted development
Both use AI to write code. The difference is who understands the result and who is accountable for it.
In vibe coding, the AI writes the software and nobody reviews it. The person prompting may not be able to tell good code from dangerous code, and often doesn’t try.
In AI-assisted development (sometimes called AI-accelerated development), experienced engineers use the same kinds of tools to work faster, then review, test and secure everything before it reaches production. The AI drafts. The engineers design the architecture, check the logic, decide what ships and stay responsible for it afterwards.
The difference is easy to miss in a demo, because both approaches can produce something that looks finished on day one. It shows up later: in the first security review, the first integration, the first thousand users and the first change request.
Is vibe coding safe for business software?
For a prototype or a personal tool, it’s usually fine. For software that handles customer data, payments, logins or day-to-day operations, it isn’t safe without an experienced developer reviewing the code, because the problems that matter most are the ones you can’t see by clicking around.
Go back to the physiotherapy booking app. It works in the demo: you can book, pay and get a confirmation email. Here’s what an engineer would check before letting a real patient near it.
What are the risks of vibe coding?
- Data any user can read. AI tools often build the screens correctly but forget the rules that stop one user seeing another’s records. In 2025, security researchers found apps built with popular vibe coding tools exposing personal data because those database permissions were missing. In our example, a patient changing a number in the web address could see someone else’s appointments and medical notes.
- Secrets in the wrong place. Payment and email service keys end up in code that runs in the visitor’s browser, where anyone can copy them.
- Missing validation. Forms accept anything, so bad data and malicious input reach the database.
- An AI with too much access. Agents that can run commands can also run the wrong ones. In July 2025, an AI coding agent on Replit deleted a company’s live database during a code freeze, despite being told not to make changes.
- Code nobody can maintain. Each prompt patches the last, so the code grows inconsistent. When the app needs a new feature or a developer has to fix a bug, it can be quicker to start again.
- No plan for growth. Slow database queries and fragile integrations don’t show up with ten test users. They show up with a thousand real ones.
None of these is visible in a demo. All of them can cost a business money, customers or a data breach report to the Office of the Privacy Commissioner of Canada.
Software that looks finished in a demo can still be unsafe in production. The risks that matter are the ones you can’t see by clicking around.
Can you build production software with AI?
Yes, and most professional development teams now do. The difference is the process wrapped around the AI. In our projects it runs like this:
- Workshops and requirements first. We map the workflows, users, data and integrations before any code is generated, so the AI is building the right thing.
- AI-accelerated prototyping. Interfaces and early versions come together quickly, so you can react to something real within days and change your mind cheaply.
- Engineering review. Developers review the generated code for architecture, API design, database structure and authentication. Code that’s wrong gets rewritten, however quickly it was produced.
- Testing and security. Automated tests, vulnerability scanning and checks on who can see what, before anything handles real data.
- Controlled deployment. Version control, separate staging and live environments, secrets stored securely and backups in place.
- Ongoing support. Someone stays responsible for the software after launch.
A real example: Life and Death Matters
Life and Death Matters, a palliative care resource provider, was paying a large annual fee for a CRM and marketing automation platform while using only a small part of it: contact management, reminders, deal tracking and email. Most of the advanced automation was lightly used or not needed.
We rebuilt the system around how their team actually works. AI-assisted development sped up prototyping and iteration, so the team could give feedback early and often. The generated code still went through a full engineering review before release, covering API logic, authentication, database handling, code structure and wider security.
The result is a simpler platform that fits their workflow and costs far less to run than the subscription it replaced. We wrote about the cost side in more detail in paying for SaaS every year, or once for a tailored AI build.
Speed or stability: what matters more?
Both, and the order matters. AI has made the first version of a piece of software much faster to produce, which is good for testing ideas and getting value sooner. But launch day is the start of a system’s life. Over the years that follow, maintenance and change usually cost more than the original build.
Say the physiotherapy clinic’s booking app goes well. Next year they want it to sync with their practice management software, send reminders by text and handle a second clinic. If the first version was built with clear structure and tests, those changes are routine. If it was vibe coded, each one risks breaking something else. A few hours spent planning for likely integrations at the start can save a rebuild later.
When vibe coding makes sense
Used for the right job, it’s a useful tool:
- testing whether an idea is worth building before you pay for development;
- a clickable mock-up to show investors, users or a development team what you mean;
- a personal tool that touches no customer data and that nobody else depends on.
If your prototype proves the idea, treat it as a detailed brief rather than version one. Hand it to engineers who will rebuild what matters properly.
How we approach AI-assisted development
We use AI to speed up prototyping and development, with every line reviewed, tested and secured by our in-house engineers before it goes live. We don’t deliver client software by vibe coding. AI sits inside a process that keeps our people accountable for the result. You can read more about how we work on our AI-assisted development page, or see how our fractional development team supports software after launch.
FAQs
What is vibe coding?
Vibe coding is building software by describing what you want to an AI tool and accepting the code it generates without reviewing or fully understanding it. The term was coined by Andrej Karpathy in 2025. It’s quick and accessible, which makes it useful for prototypes, but the code often hides security and maintenance problems.
Is vibe coding safe for business software?
Not on its own. Vibe-coded apps often have missing access controls, exposed keys and weak validation that don’t show up in a demo. For software that handles customer data, payments or business operations, the code needs review, testing and security checks by experienced developers before it goes live.
What is the difference between vibe coding and AI-assisted development?
In vibe coding, AI writes the software and nobody reviews it. In AI-assisted development, engineers use AI tools to work faster but design the architecture themselves, review and test all generated code, and remain responsible for the software after launch.
Can a vibe-coded prototype be turned into a real product?
Often it’s best used as a working brief. Developers can keep the parts that are sound, but the data model, security and core logic usually need to be rebuilt properly before real customers use it.
