What Is Vibe Coding? Meaning, Risks and How to Review It

What is vibe coding?

Vibe coding is a way of building software by describing what you want in plain language and letting an AI coding tool write much of the code. Instead of starting from a blank editor, you start with intent: "make a booking form," "add a dashboard," or "connect this page to my customer list." You try the result, say what is wrong, and the AI changes the code.

AI researcher Andrej Karpathy described the idea in a post in February 2025: you lean on the AI's output and judge the app by whether it behaves the way you want, rather than by reading every line. The word "vibe" does not mean guessing. It means working at the level of direction and judgment instead of controlling each technical detail.

One point matters from the start: code written by AI is still code. It can produce useful pages, workflows and automations, and it can also hide problems you cannot see on the screen. A form can look finished while mishandling private data, and a login page can appear to work while missing the checks that keep one user out of another user's records.

How vibe coding works, step by step

Here is the usual loop for a small business tool, such as a page where staff log follow-up calls:

Describe the goal. Start with the outcome, not the technology: who uses it, what they enter and what should happen next.
Add the details. The more specific the workflow, the less the AI has to assume.
Ask for a first version. The tool may create screens, forms, database tables and logic. Treat it as a draft.
Run it with sample data only. Do not paste real customer records, passwords, API keys or payment details into an unreviewed build.
Give feedback in plain language. "The staff list should show only active employees." "The form should reject a blank email address."
Repeat until the visible workflow works. This is where vibe coding feels fast.
Review what was created. Check security, data handling, access rules, dependencies and code quality before launch.
Decide what it is. A demo, an internal tool, or something that needs a developer before customers use it.

"It runs on my screen" is not the same as "it is safe for the business." Speed is the strength of vibe coding; readiness is a separate question.

Kinds of vibe coding tools

Products change often, so here are the kinds of tools rather than brand names:

Chat-based coding assistants answer questions, write snippets and explain errors.
Code editor assistants work inside a coding workspace, suggesting and changing code in the open project.
AI app builders create a whole app from a prompt, often with screens, a database and basic workflows.
Agent-style tools carry out multi-step tasks: create files, run tests, read errors and try fixes. They move fast and still need a person to check the result.
Testing and review helpers generate test cases or flag possible problems. They can support a review but should not be the only review.

The practical difference is how much you can see. A builder that hides the files is easier on day one; a tool that shows each change makes review and maintenance easier later.

What vibe coding is good for

Vibe coding fits work where a rough first draft is cheap and waiting is expensive:

Demos of a customer portal, booking flow, calculator or dashboard, to show people what you mean.
Internal tools such as staff-only forms, lead trackers or simple reports, with few users and little sensitive data.
Workflow experiments to test whether a new process is worth building properly.
Small automations that format or organize information and save repetitive work.
Learning projects that help non-developers see how software fits together.

The more important the app becomes, the higher the bar. A customer-facing system, anything that takes payments, and anything that stores health, legal or financial records deserves a far more careful build than a quick demo.

Is vibe coding bad?

Vibe coding is not automatically good or bad. It is a method, and its value depends on what the app does and whether the output is reviewed before real use.

The upside is real: it lowers the barrier to building software, lets owners test ideas, speeds up early drafts and gives developers a head start on routine code. The downside is just as real: AI can produce code that looks polished and still has hidden problems, and a non-developer may not know whether the database is protected, whether each user sees only their own records, or whether a library comes with license terms. The danger is not that AI was involved; it is treating unreviewed output as finished.

A sensible split: use vibe coding for momentum, and use review for confidence.

The real risks in a vibe-coded app

Exposed API keys and secrets. Keys, passwords, database credentials and tokens must never sit in browser code, public files, screenshots or prompts that do not need them. Store them in protected settings, and replace any key that was exposed.
Missing login and access checks. A login screen is not enough. The app must check, on every page and every record, what that user is allowed to see and change.
Unvalidated input. Every field, upload and selection needs checks, so blank, malformed or hostile input is rejected before it is stored or processed.
Technical debt. Duplicated logic, confusing structure and quick fixes stacked on quick fixes may not matter in a throwaway demo, but they make a daily-use app hard to change.
Dependencies and licenses. AI-built apps pull in outside packages and templates. Each may need updates, may carry known flaws, or may have license terms that limit how you use it.

Security and code review checklist before launch

Use this before a vibe-coded app touches customers, staff accounts, private records, payments or live systems. If you are not technical, hand it to the developer or security reviewer as a brief. A secure code review reads the code, not just the screens.

Write down the users, the main workflows, the data collected and the systems the app connects to.
Keep testing on sample data until the review is done.
Search the files, browser code, shared documents and prompts for keys, passwords and tokens.
Replace any secret that was pasted into a prompt, committed to code or shared.
List which pages need a signed-in user and which must never be public.
Test each role: can it see or change anything it should not?
Try blank fields, wrong email formats, very long text, odd characters and wrong file types.
Check what is stored, where, and whether the app keeps more than it needs.
List the outside packages, templates and services, and check their licenses fit your use.
Ask the reviewer to point out duplicated code, fragile workarounds and features nobody asked for.
Have someone who did not build it complete the main workflow.
Decide in writing what the app is for now (demo, internal tool, small trial or full release) and who maintains it.

When to bring in a developer

Bring in a developer, or at least a reviewer, when the app will hold customer or patient data, take payments, connect to accounting or other business systems, or become something staff rely on every day. A developer can review what the AI produced, rebuild the risky parts and set up updates and backups.

Vibe coding works best with clear boundaries: describe the goal, generate a draft, test the behavior, review the code, then decide how the app may be used.

Where ASL fits

If an AI-built app is starting to matter, ASL's custom software development work starts by reviewing the current source, how it runs and your permission to change it. The result may be a small set of fixes rather than a rebuild. Source ownership, hosting and support after launch are written into the project agreement.

For a security check of a live website or web app, ASL Scan is delivered as an authorized engagement: a signed authorization names the exact hosts, an analyst reviews every report, and pricing is quoted per engagement. A passing check does not prove a system is free of flaws.

Frequently asked questions

Who coined the term vibe coding?

AI researcher Andrej Karpathy described it in a post in February 2025: building software by leaning on what the AI writes and judging the result by whether it works, rather than by reading every line.

Is vibe coding the same as using an AI coding assistant?

Not quite. Many developers use AI assistants and still read and test every change. Vibe coding leans further: the builder accepts most of what the AI writes and steers by behavior. The same tools can be used either way.

Can I launch an app I built with vibe coding?

For a demo or a small internal tool with sample data, yes. Before real users, payments or customer records, have it reviewed for secrets, access checks, input handling, dependencies and licenses.

What is the biggest security risk in a vibe-coded app?

Most often it is access: pages or records that any signed-in user, or anyone with the link, can open. Exposed API keys are a close second; replace any key that was pasted into a prompt or committed to code.

What does a secure code review cover?

It reads the code, not just the screens: how secrets are stored, which checks guard each page and record, how input is validated, which dependencies are used and whether their licenses fit, and what is logged.

Related guides

Explore the complete product

Read features, current access and limitations

What Is Vibe Coding? Meaning, Risks and How to Review an AI-Built App