Vibe Coding: Build an App in Hours —
But Read This First

Imagine describing the app you want to build to a colleague who happens to be a world-class developer, and watching them build it in real time as you talk. That is, more or less, what vibe coding tools do in 2025.

"Vibe coding" — the term popularised by AI researcher Andrej Karpathy — refers to building software through conversational AI prompts rather than writing code yourself. You describe what you want. The AI writes it. You iterate by describing changes. No syntax, no debugging, no Stack Overflow.

The results have been remarkable. Lovable hit $100M ARR in 8 months — one of the fastest SaaS growth curves ever recorded. Cursor's parent company reached a $9.9B valuation. These are not novelty products. They are platforms that have fundamentally changed who can build software and how fast.

But with that power comes a set of risks that are easy to miss when you're riding the dopamine hit of watching an app materialise from a prompt. This guide covers both sides honestly.

What Is Vibe Coding, Exactly?

Traditional software development requires writing code line by line — knowing the syntax of a programming language, understanding how different components connect, and spending hours debugging when things break. It takes years to learn and even experienced developers spend a significant portion of their time on mechanical tasks.

Vibe coding replaces most of that mechanical layer. You describe what you want in plain language — "create a dashboard that shows my monthly revenue, with a filter for date range and the ability to export as CSV" — and the AI writes the code. You review the result, describe any changes ("make the chart blue, and add a total at the top"), and the AI updates it.

The name comes from the experience: you're not thinking about code. You're thinking about the product. You're in a flow state describing your vision, and it materialises. You're coding on vibes.

The Tools: What Each One Is Best At

Where Vibe Coding Genuinely Shines for Business Owners

The pattern that consistently works is using vibe coding tools for what they're excellent at — speed and experimentation — and bringing in professional development once the concept is validated and ready to scale.

The Risks You Need to Know Before You Deploy

Here is where we shift from enthusiastic to honest. The productivity gains from vibe coding are real. So are the risks. And they are not the kind you discover in testing — they're the kind you discover when something goes wrong in production.

1. Security vulnerabilities are endemic to AI-generated code

AI-generated code is optimised to look correct and run correctly under normal conditions. It is not optimised for adversarial conditions — what happens when a malicious user tries to access another user's data, inject malicious SQL, or exploit an authentication flaw. Security thinking requires anticipating attacks that the AI has no reason to anticipate when generating code for a happy-path use case.

The specific vulnerabilities that appear most frequently in AI-generated code are:

• Broken row-level security — Users can access data that isn't theirs.
• Exposed API keys — Credentials committed to code or exposed in client-side bundles.
• Missing input validation — Fields that accept data without sanitising it, enabling injection attacks.
• Insufficient authentication checks — Routes or actions that should require login but don't.
• Insecure dependencies — AI-recommended libraries that are outdated or have known vulnerabilities.

2. Logic degrades at complexity and scale

A rigorous 2025 study found that experienced developers using AI coding tools actually took 19% longer to complete complex tasks — despite believing they were 20% faster. The perception of productivity gains is real. The actual gains, for complex work, are not always there.

For simple, well-defined tasks — "create a login page", "add a search filter to this table" — AI tools perform brilliantly. For complex business logic — "calculate refund eligibility based on these twelve conditions, accounting for subscription status, purchase date, and whether the user has claimed this discount before" — the results are inconsistent and require significant human review.

The issue isn't that AI can't write complex code. It's that complex requirements are hard to specify precisely in natural language, and AI fills the gaps with reasonable-seeming assumptions that may be completely wrong for your business context.

3. Codebases degrade over time

The 50th prompt produces worse code than the 5th. As a project grows:

• The AI context window fills up, causing it to lose track of earlier decisions.
• Patterns become inconsistent as different prompts generate different approaches to the same problem.
• The codebase becomes difficult for a human developer to understand and maintain — defeating one of the core reasons to use a professional.

What began as a 2-hour build can become a 20-hour debugging nightmare six months later. We've seen this pattern consistently in businesses that ship vibe-coded apps to production and then need us to rescue them.

4. AI is non-deterministic

The Professional's Workflow: How to Use These Tools Responsibly

The answer is not to avoid these tools. The answer is to understand exactly what they're good for and where to hand off to professional oversight.

The Non-Negotiable Checklist Before Going Live

• 🔒 Has a professional reviewed the authentication and authorisation logic?
• 🗄 Have row-level security policies been tested by someone other than the builder?
• 🔑 Are all API keys stored as server-side environment variables, not in client code?
• 🧪 Has the app been tested with an adversarial mindset — attempting to access other users' data?
• 📋 Does the app comply with GDPR for any UK or EU user data it handles?
• 💳 If payments are involved, has a PCI-qualified developer reviewed the integration?
• 📦 Have the dependencies been scanned for known vulnerabilities?

The Bottom Line

Vibe coding tools represent a genuine shift in who can build software. For rapid validation, internal tooling, and non-sensitive applications, they are excellent — genuinely faster and more accessible than traditional development. Every founder should know they exist.

For anything that handles user data, authentication, payments, or that you plan to scale beyond a handful of internal users, treat AI-generated code as a first draft — valuable, but requiring professional review before you'd trust a structural engineer's report that hadn't been checked by a qualified professional.

The fastest and cheapest outcome — combining AI tool speed with professional security and architecture review — is almost always better than the alternatives: either slow traditional development from scratch, or deployed vibe-coded apps that create security incidents later.

Related Reading