What is vibe coding, and why does it make you feel like a superhero?
Andrej Karpathy, one of the founders of OpenAI, coined the term in a post on X in February 2025. He was describing a new way to program. You ask the AI for what you want, accept every change without reading it, and paste the errors back until they go away. He wrote that it is "not too bad for throwaway weekend projects". Collins Dictionary later picked it as its word of the year.
The superhero feeling is real. Pieter Levels, who builds apps alone, said on X that he made a flight simulator with Cursor, an AI code editor, in about three hours. Just over a fortnight later, he wrote, tens of thousands of people were playing it in a day.
Meanwhile hackers and bots had arrived, and he added one patch after another. He concluded that "100% vibe coding is very fun but then gets messy very fast". Great for prototyping, he added.
When does vibe coding save you time?
It pays off when mistakes are cheap. Think of a quote-request form to show your business partner, or a draft shift portal for three colleagues to try. Instead of weeks of meetings, you put something that works on the table.
Simon Willison, co-creator of Django, a widely used tool for building websites, encourages anyone to try it. His blog asks for low-stakes projects, care with keys and private data, and an expert's check if others will use the app.
Where does an app you built alone break?
Exposed keys and data
Moltbook, a social network for AI agents that went viral early this year, is the case everyone cites. According to Wiz, a security company, its founder had said on X that he didn't write a single line of code. Wiz found a key in the page that opened the whole database, with 1.5 million agent access keys, 35,000 email addresses and private messages. One protection setting was missing, and it was fixed within hours.
It isn't a one-off. Matt Palmer, who works at Replit, a Lovable competitor, analysed 1,645 apps made with Lovable. In 170 of them, data such as names, phone numbers, payment details and keys to other services could be read without permission.
An agent that deletes the database
In July 2025 Jason Lemkin, of SaaStr, posted on X about day nine of vibe coding with Replit. The AI agent deleted the production database, despite being told not to touch anything. Amjad Masad, Replit's CEO, replied that it was "Unacceptable and should never be possible", and began separating test data from live data. Lemkin later clarified that the app was still a demo, and the data was restored.
Code nobody understands
Karpathy himself admitted that the code grows beyond his usual comprehension. For a game that's fine, for your order system it isn't, because every change becomes a gamble. This is technical debt, meaning today's shortcuts that you pay back with interest.
The risk can be measured. Veracode, which regularly tests code written by AI models, finds a known vulnerability in roughly 4 in 10 tasks. And developers know it. In Stack Overflow's annual survey, 48% trust AI only when they can easily verify the output. Someone working alone usually can't.
When users multiply
A prototype can handle ten colleagues. With thousands of users come bots and abuse, as Levels found, and usage-billed services cost more with every visit. Greg Isenberg, an entrepreneur who hosts a startup podcast, talks about bread taken out of the oven too soon, nice outside and raw inside. For him the real baking is the last 20%, made of security, data and trust.
Rules for companies and public bodies
If the app collects personal data, GDPR Article 32 asks for security fit for the risk, and regular testing. If data leaks, Article 33 asks you to notify the supervisory authority, normally within 72 hours. You are the controller, whoever wrote the code.
The EU AI Act looks at what the app does instead. If it filters CVs or assesses candidates with AI, it is a high-risk system with its own duties. Italy's public sector has one more step. A public body's cloud services must be qualified by the National Cybersecurity Agency (ACN). The platform that was handy for the prototype may not be.
What does it cost to rebuild?
Our read: the cost of vibe coding shows up after launch. Once customers are in, it often pays to rebuild the parts that handle data and permissions rather than patch them. And you do it while the app is in use. The prototype still earns its keep, because it shows what you want better than any written spec.
Some people see it differently. Isenberg writes that many are building real products with AI that could scale. Simon Høiberg, who sells software products, says it is now just normal software engineering. And Veracode reports the first improvement in its series. Tools improve, but whoever publishes an app answers for it.
What about us?
How we would do it: we start from your prototype, not from scratch. We read the code and look for keys in plain text and open tables. We separate test data from live data, set up backups you can restore and write tests for the parts that touch money and personal data. Then we decide with you what to keep and what to rebuild. That's the work of our Custom Software Delivery service, where you own the logic and the data.
We use fast tools too, and that platform was built on FlutterFlow and Firebase. Speed is fine. The risk starts when, after launch, nobody answers for the app.
So what should you do with your prototype?
- If it's a test for you or a few colleagues, with no personal data or payments, keep vibe coding.
- If the app will collect customer or citizen data, have its keys, database permissions and backups checked before you open it.
- If an AI agent can change code or data, keep test and production apart.
- If the app must handle many users, payments or a public tender, treat it as a software project, with a team that answers for it.
“Vibe coding gets you to a prototype in a weekend. Getting to customers takes someone who reads the code and answers for it.”
DBrothers — how we take a prototype to production
If you have a prototype built with vibe coding and want to put it in front of customers, bring it as it is. We'll read it together and tell you what to keep, what to fix and what to rebuild before launch.
