What is vibe coding? Definition, how it works and where it breaks

Vibe coding is writing software by describing what you want to an AI in plain language and accepting the code it returns without reading it line by line: you prompt, run the app, see if it works and ask for changes. Andrej Karpathy coined the term on 2 February 2025, and within months it went from a programmer's joke to a dictionary's word of the year.

It is a great way to reach a prototype that looks and feels like a product. It is a poor way to reach something that takes payments, stores other people's data and survives an attack. This guide covers both halves, with sources.

Where the term comes from

The primary source is a post by Andrej Karpathy (former director of AI at Tesla, founding engineer at OpenAI) on X, published on 2 February 2025 at 23:17 UTC:

There's a new kind of coding I call "vibe coding", where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.

He adds that it is possible because LLMs (he names Cursor Composer with Sonnet) are "getting too good", and that he talks to the editor with SuperWhisper. Source: the original post. In November 2025 Collins Dictionary named it word of the year, defining it as "the use of artificial intelligence prompted by natural language to assist with the writing of computer code" (CNN, 6 November 2025).

The most-cited distinction is Simon Willison's, from 19 March 2025: vibe coding is building software with an LLM without reviewing the code it writes. If you review, test and understand the output, that is AI-assisted development, not vibe coding (Willison). The risk is not using AI; it is not looking at what the AI did.

How it works, and with what

The loop: describe the app or change, let the tool generate screens and code, try it in the browser, paste errors back to the AI, repeat. What defines vibe coding is what is missing from that loop: reading the diff, writing tests, checking permissions, asking what happens when the same webhook arrives twice.

Lovable, Bolt and v0 target people who code little: they generate web apps or UI from the browser. Cursor and Claude Code target developers: an AI editor and a terminal agent that work on a repository. Replit offers an in-browser environment with an agent. For the developer end, we have configuration guides: a CLAUDE.md example for a SaaS, Claude Code hooks that enforce architecture and Cursor rules for Next.js and TypeScript.

Where it breaks

Data security. Researcher Matt Palmer and his team scanned 1,645 Lovable projects on 21 March 2025 and found 170 with inadequate row-level security (RLS) settings, with 303 Supabase endpoints identified. The scan only looked at homepages (Palmer's statement). The pattern was registered as CVE-2025-48757; the NVD record says insufficient RLS let remote unauthenticated attackers read or write arbitrary tables of generated sites, and notes that the vendor disputes it because each customer is responsible for protecting their app's data. Either way, nobody writes that policy unless you ask. A vibe-eval.com report, relaying a manual audit of 50 apps (Cursor, Lovable, Bolt, v0) posted on Reddit, says 90% share the same five vulnerabilities, hardcoded API keys among them (report).

Multi-tenancy and payments. A query that forgets its organization filter compiles and demos fine, then leaks data between customers. A write-up on Claude Code and boilerplates notes that code generated from an empty repo averages years of public code, and "the average includes the bugs"; its example of a payments bug is "If Stripe sends the same message twice (which it does), your app charges or credits the user twice" (buildthisnow.com).

Agents with reach into production. In July 2025, SaaStr founder Jason Lemkin documented Replit's agent deleting his production database during a code freeze, despite his instructions. According to Lemkin it also generated a 4,000-record fictional database and told him a rollback was impossible, though he later wrote that the rollback worked (The Register). Fortune reported the deletion wiped out data for "more than 1,200 executives and over 1,190 companies", and that Replit rolled out automatic dev/production database separation and better rollbacks, with a planning-only mode in development (Fortune). Telling the agent not to touch production is not a security model.

For the tool-by-tool risks and fix plans see the /fix hub. The long versions are where vibe-coded SaaS apps break and how to secure a vibe-coded app.

When to move to a base

Vibe coding is right for validating an idea, a demo or a low-risk internal tool. Move when you will take payments, store other people's data, serve more than one customer organization, or let an agent keep editing the code and want the compiler and CI, not a prompt, to stop rule-breaking changes.

useDeploy is a paid TypeScript SaaS boilerplate (Next.js and Express on Bun, Prisma, BetterAuth) with multi-tenancy, RBAC and Polar billing. MercadoPago Checkout Pro one-time payments with signed webhooks work; the Stripe adapter is a scaffold that does not charge yet. For agents it ships ESLint-enforced architecture layers, Claude Code hooks and an AGENTS.md. If you only want the rules, claude-code-guardrails is the open kit. The full crossing is in From a Lovable/Bolt mockup to a real backend.

FAQ