Vibe coding · 9 min read

What is vibe coding?

You describe what you want in plain English; an AI writes the code. That's the whole idea — and in barely a year it went from a single tweet to how a real share of software now gets built. Here's what it actually means, how it compares to no-code, where it works, how to start, and how to do it without shipping a security hole.

VThe Vertos teamUpdated September 2026

Vibe coding is building software by telling an AI what you want in ordinary language and letting it write and change the code — with little or no line-by-line coding from you. Instead of authoring every function, you steer: describe the feature, look at what the AI produces, run it, and say what to fix next. The term is barely a year old, yet it has already rewired how prototypes, side projects, and a growing number of production apps get made.

The originWhere the term came from

"Vibe coding" was coined by Andrej Karpathy — a co-founder of OpenAI and former head of AI at Tesla — in a February 2025 post. He described a new way of building where you "fully give in to the vibes" and "forget that the code even exists," possible because the AI models had finally gotten good enough to drive from natural-language prompts. The name stuck because it captured the feeling exactly: less typing, more directing. Within months it had jumped from a tweet to conference stages, dictionaries, and even Y Combinator's requests for startups.

"There's a new kind of coding I call vibe coding, where you fully give in to the vibes, embrace exponentials, and forget that the code even exists."

— Andrej Karpathy, February 2025

How it worksThe describe-generate-test-refine loop

Vibe coding isn't one prompt and done. It's a short, fast loop you run over and over until the thing works:

1DescribeTell the AI what you want in plain language — "a page where users upload a CSV and see a chart of the totals."
2GenerateThe AI writes the code — files, functions, UI, and all — and often runs it for you.
3TestYou try it. Something's off, or an error pops up, or it's 90% right.
4RefineYou give the next instruction — "good, now add error handling for a missing file" — and the loop repeats.

…repeat until it works. The skill isn't syntax anymore — it's describing intent clearly.

The comparisonVibe coding vs no-code vs traditional coding

People often confuse vibe coding with no-code. They're not the same. No-code assembles an app from a platform's visual blocks; vibe coding produces real source code you own. Here's the honest side-by-side:

 Vibe codingNo-codeTraditional coding
How you buildDescribe it; AI writes real codeDrag & drop visual blocksWrite every line yourself
Who it's forAnyone who can describe an ideaNon-technical, zero codeDevelopers
CeilingHigh — it's code, extend it freelyLimited to the platformUnlimited
You own the code?Yes — host it anywhereNo — locked to the platformYes
Best forCustom apps, prototypes, going to productionSimple sites & internal toolsLarge or safety-critical systems

The short version: no-code is faster for standard, simple apps but hits a wall; traditional coding has no ceiling but a steep on-ramp; vibe coding sits in between — real, ownable code without writing every line, which is why so many side projects now start there.

The honest pictureWhere it shines, where it strains

✓ Shines
  • Prototypes and MVPs — an idea to a working app in an afternoon
  • Non-developers building real, useful tools
  • Boilerplate, UI scaffolding, and glue code
  • Learning by doing — you see working code fast
  • Getting unstuck when you know what, not how
△ Strains
  • Large, complex codebases with lots of hidden context
  • Security-sensitive or regulated systems
  • Anything where you can't review what was written
  • Debugging problems the AI itself introduced
  • Long-term maintainability if no one understands the code

The catchThe security reality

Here's the part the hype skips. AI writes plausible code fast — and plausible isn't the same as safe. Research through 2026 found AI-generated code carries materially more security flaws than human-written code, and when researchers scanned thousands of live vibe-coded apps, the results were sobering:

2,000+ vulnerabilities and 400+ exposed secrets were found in a single scan of ~5,600 publicly deployed vibe-coded apps. The tools didn't fail — people shipped the output without reading it. The classic pattern: AI writes a database query that drops user input straight in, it works fine in testing, and it's wide open to SQL injection in production.

The mental model that keeps you safe: treat your AI like a brilliant but inexperienced junior developer. It produces code at an incredible rate, but it doesn't understand your architecture, your threat model, or what "secure" means for your app. Every line still needs a real review. (We dug into the data in why ~45% of AI code ships vulnerable.)

Getting startedHow to start vibe coding

You can be productive in an hour. The trick is to start small and stay in the loop rather than asking for a whole app at once:

1Pick a toolAn AI editor (Cursor, Claude Code, Windsurf) if you'll touch the code, or a prompt-to-app builder (Lovable, Bolt, v0) if you won't.
2Start with one featureNot "build me a CRM" — "a form that saves a name and email to a list." Small, specific, testable.
3Describe clearly, then iterateSay what you want, run it, and give the next instruction. Precision in the prompt beats cleverness.
4Review as you goRead each change before you accept it, and ask for security explicitly ("use parameterized queries," "validate input").
5Test before you shipTry the edge cases, write a couple of tests, and run a dependency and static scan on anything real.

The big questionWill vibe coding replace developers?

Not outright — and probably not the way headlines imply. Vibe coding collapses the barrier to starting software, so far more people can build than ever before. But the hard parts of engineering don't vanish: reviewing AI output, securing it, debugging what the model got subtly wrong, and scaling it under real load still take judgment a prompt can't supply. The likelier shift is in where the work goes — less time typing boilerplate, more time directing, reviewing, and hardening. Developers who lean into that become faster; the role changes shape rather than disappearing.

Do it rightVibe coding without the footguns

✦ The safe-vibe checklist
Review every diff. Treat AI output as an untrusted first draft, not finished code — read it before you accept it.
Never put secrets in prompts. No API keys, passwords, or real customer data in the chat — and check none got hard-coded into the output.
Ask for security in the prompt. Say "use parameterized queries," "validate and sanitize input," "don't log secrets" — it listens when you ask.
Test and scan before shipping. Run it, write a few tests, and put it through a static-analysis and dependency scan.
Keep a human in the loop for anything real. Prototypes can be loose; anything touching money, auth, or personal data needs a careful eye.
Not sure which tool to vibe-code with? We broke down the whole field — Cursor, Windsurf, Claude Code, Copilot, Bolt, Lovable, and v0 — by what each is actually best at: the best vibe coding tools in 2026. And when you're ready to ship, here's how to make a vibe-coded app production-ready.

The bridgeFrom vibe-coded to valuable

Here's the part builders miss: a vibe-coded app with real users is a real asset. The barrier to starting software just collapsed, which means more projects exist — and more of them get abandoned. If yours found some traction, it can be worth selling for real money; buyers just look closely at the code, which is exactly why clean, reviewed code is worth more. And if you're on the buying side, a vibe-coded app can be a bargain — as long as you read the code before you commit.

Common questionsFrequently asked questions

What is vibe coding?

Vibe coding is building software by describing what you want in plain, natural language and letting an AI generate and modify the code, with little or no line-by-line coding by you. Instead of writing every function, you guide an AI assistant through a conversation — describe, generate, test, refine — until the app works. The term was coined by AI researcher Andrej Karpathy in early 2025.

Who coined the term vibe coding?

Andrej Karpathy, a co-founder of OpenAI and former director of AI at Tesla, coined 'vibe coding' in a February 2025 post. He described a new kind of coding where you 'fully give in to the vibes' and 'forget that the code even exists,' made possible because AI models had gotten good enough to drive the process from natural-language prompts.

What is the difference between vibe coding and no-code?

No-code tools like Bubble or Webflow let you assemble an app from visual building blocks, but you never touch code and you’re locked into that platform. Vibe coding produces real source code that an AI writes from your prompts — you own it, can host it anywhere, and can extend it without hitting a platform ceiling. No-code is faster for simple, standard apps; vibe coding is more flexible and travels to production.

How do I start vibe coding?

Pick an AI coding tool (Cursor, Claude Code, Windsurf, or a prompt-to-app builder like Lovable, Bolt or v0), start with one small, well-defined feature, and describe it clearly in plain language. Run what the AI produces, tell it what to fix, and repeat. Review each change instead of blindly accepting it, keep secrets out of your prompts, and test before you ship. Clear intent — not syntax — is the skill that matters.

Is vibe coding safe?

Vibe coding is safe when you review and test what the AI writes — and risky when you don’t. Studies in 2026 found AI-generated code contains materially more security flaws than human-written code, and scans of thousands of deployed vibe-coded apps uncovered thousands of vulnerabilities and hundreds of exposed secrets. The fix is process: treat AI output as an untrusted draft, review it, keep secrets out of prompts, and run security and dependency scans before you ship.

Will vibe coding replace developers?

Not outright. Vibe coding removes the barrier to starting software, so far more people can now build — but reviewing, securing, debugging, and scaling AI-written code still takes real engineering judgment. The likeliest outcome is a shift, not a replacement: developers spend less time typing boilerplate and more time directing, reviewing, and hardening what the AI produces.

Vibe-coded something with traction?

List it on Vertos free — a built-in AI Analysis shows buyers exactly what's in the code, so a well-built app earns its price. Or buy one that's already made and skip the blank page.

Browse projects →

Give in to the vibes — carefully.
— The Vertos team

Sources & notes

Definition and history per MIT Technology Review and Google Cloud; the origin is Andrej Karpathy's February 2025 post. Security figures from IBM and TechTarget; best practices draw on the Cloud Security Alliance guide. General education, not security advice for a specific system.