Short answer
Vibe coding is building software by describing what you want to an AI coding assistant, accepting its changes without reading them, and pasting any errors back until the program works. It is a fast way to make a throwaway prototype, but it breaks down as soon as the app holds real data, needs to be maintained, or must be secure.
Follow-up question How do you keep a vibe-coded app safe?
The phrase comes from Andrej Karpathy, a well-known AI researcher, who described a new habit in a post on X in early February 2025. He talks to an AI coding tool by voice, clicks to accept every change, and no longer reads the differences between versions of the code. When an error appears, he pastes the message back without comment, and that usually fixes it. In his words, "I 'Accept All' always, I don't read the diffs anymore." He presented it as fine for throwaway weekend projects, and noted that the code soon grows past what he fully understands.
The name stuck because many people recognize the experience. AI coding assistants, tools that write and edit code from plain-language requests, have become good enough that a person with little programming experience can get a working app in an afternoon. What vibe coding removes is the step where a human reads and understands the code.
How a vibe-coding session goes
Here is a typical sequence for a small app: a sign-up page for a community garden's volunteer shifts. Each line is a request typed or spoken to the assistant.
Make a simple web page where volunteers enter their name, email and pick a Saturday shift. Save the sign-ups and show a list of who is coming.Make the list sorted by date and add a button to cancel a sign-up.I get this error when I click Cancel: [pasted error]. Fix it.After a few rounds, the page works in the browser. That is the appeal: the person describes outcomes, the assistant handles the code, and the feedback loop is fast. Some developers add structure without giving up speed. The engineer Vivek Haldar, for example, first has a model write a product description and a design document, then gives both to a coding assistant and asks it to write tests as well, so there is something to check the result against.
Where it breaks
Vibe coding has weak points that show up in predictable places:
| Where | What tends to go wrong |
|---|---|
| Security | Anyone can open the page and read or delete every sign-up, because nobody asked for a login or checked the code |
| Personal data | Names and emails are stored in a plain file or a public database with no protection |
| Secrets | A password or API key (the private code that unlocks a paid service) is written directly into the code and published with it |
| Hidden bugs | Errors are "fixed" by working around them, so the real cause stays in the code |
| Maintenance | Months later, nobody, including the person who built it, knows how the app works or how to change it safely |
| Cost | A program that calls a paid service in a loop can run up charges unnoticed |
Research backs up the security concern. In a Stanford user study first posted in 2022, people who had an AI code assistant while solving security-related programming tasks produced significantly less secure code than people without one. They were also more confident that their code was secure. Participants who trusted the AI less and worked harder on their requests did better. Vibe coding, by design, removes exactly that skepticism.
Try it: Take any small app you or an AI built quickly and ask a fresh chat: "Here is my code. List every place where a stranger could read, change or delete data, and every secret written into the code. Do not fix anything yet." Compare the list with what you assumed.
When vibe coding is the right tool
None of this makes it useless. It is a good fit for prototypes you will throw away, personal tools that run only on your own computer, quick demonstrations of an idea for a meeting, and learning what is possible. The line to watch is the moment the app touches other people: their data, their money, or their trust. At that point, someone has to read the code, or at least test it against a clear checklist.
How do you keep a vibe-coded app safe?
Start by keeping it private. Run the prototype on your own computer, or behind a password, until it has been reviewed. Use fake names and emails while you build, never real ones.
Before anyone else uses it, switch from accepting everything to reviewing. Ask the assistant to explain, file by file, what each part of the code does, and read those explanations. Then ask targeted questions: Where is data stored and who can reach it? Is every input checked before it is saved? Are any keys or passwords written into the code? Move secrets into environment variables, which are settings kept outside the code, and change any key that was ever published.
Add tests. Ask the assistant to write automated tests for the main actions, such as signing up, cancelling and listing, and read the tests yourself, since they are shorter than the app. A test that fails later tells you a change broke something before your users find it.
Keep a history of changes with a version-control tool such as Git, so you can undo a bad round of edits. Set a spending limit on any paid service the app calls. And when the app will hold personal information or handle payments, have someone who can read code look at it before launch. A quick prototype is a good start; it is not yet a finished product.
Sources
- Spec-driven Vibe-coding — Vivek Haldar (blog), February 8, 2025
- Do Users Write More Insecure Code with AI Assistants? — arXiv (Perry, Srivastava, Kumar, Boneh — Stanford), November 7, 2022