Vibe coding
Also known as: vibecoding, vibe-coding
Vibe coding is a way of building software where a person describes what they want to an AI tool in everyday language, accepts the code it writes, and keeps asking for changes until the result works, often without reading the code closely.
It lets non-programmers create apps and prototypes quickly. While vibe coding is great for experiments and personal tools, apps built this way can hide security holes and bugs that nobody on the team understands.
Vibe coding, explained at three levels
At home
Vibe coding is like hiring a builder who works fast and never shows you the blueprints. You say 'build me an app that tracks my workouts,' look at what appears, and ask for changes: 'make the button bigger,' 'it crashes when I add a run.' The AI writes and rewrites all the code. You judge only by whether the result works, not by how it's built.
At work
Vibe coding is building software by describing what you want to an AI tool in plain language and accepting the code it writes, often without reviewing it. It lets staff without programming skills produce prototypes and internal tools in hours instead of waiting weeks for developers. For a business, the speed is real, but so is the risk of code nobody understands.
At home
Tools such as Lovable, Bolt, Replit, and Cursor take your description and generate a whole app: screens, logic, and often a database. You run it, describe what's wrong, and the AI patches the code. That loop is fast and fun. But because you never read the code, you can't tell whether a fix solved the cause or just hid a symptom, so strange bugs can be hard to untangle.
At work
Vibe-coded apps often skip the safeguards developers add by habit: tests, input validation, access controls, and secret management. Common failures include databases left publicly readable because row-level security was never set, API keys hard-coded into front-end code, and missing checks on who can see which records. AI coding agents with live access add another risk, as when a Replit agent deleted a production database in 2025. Experienced developers use the same tools but review and test every change.
At home
When you vibe-code an app just for yourself, a bug costs you an afternoon. When the app stores other people's names, emails, or payments, a bug can expose them, and Canadian privacy law holds you responsible regardless of who wrote the code. While the AI writes quickly, it doesn't own the consequences. In my opinion, that's the line where vibe coding should stop and a proper review should start.
At work
Governance should define which data vibe-coded tools may touch, require automated security scanning and human code review before production, and assign an owner to maintain each app. AI agents should never get unrestricted production access; use separate environments and least-privilege credentials. Successful prototypes should be rebuilt or hardened by engineers, since code nobody understands becomes technical debt that grows with every AI-generated patch and is expensive to secure later.
Real-world examples
At home
Sophie vibe-coded a simple app to track her family's chores in an afternoon, just by chatting with an AI tool. She'd never written a line of code before.
At work
Marcus is a marketing manager at a Toronto startup. He vibe-coded a prototype event sign-up page in a day, but the company's developer found it stored attendee emails in a publicly readable database and rebuilt it before launch.
How it compares
| feature | Vibe coding | AI-assisted development |
|---|---|---|
| Who reads the code | Often nobody | The developer |
| Speed to prototype | Very fast | Fast |
| Security and quality | Unknown without review | Reviewed and tested |
| Best for | Prototypes, personal tools | Production software |
Both use AI. The difference is whether anyone understands the result.
For analysts
Vibe coding is a great way to turn a business idea into a clickable prototype. I'd require a developer review before anything touches customer data or goes live.
History & origin
AI coding assistants such as GitHub Copilot, launched in preview in 2021, suggested code to developers line by line. Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla, coined 'vibe coding' in a February 2025 post describing fully giving in to the AI and forgetting the code exists. Tools such as Cursor, Replit, Lovable, and Bolt made the approach mainstream, letting users generate whole apps from prompts. Collins Dictionary named 'vibe coding' its Word of the Year for 2025. Cautionary stories spread too, including a July 2025 case in which SaaStr founder Jason Lemkin reported that a Replit AI agent deleted a production database during an experiment. In my view, vibe coding is a wonderful way to build a prototype and a risky way to build a business.