What Is Vibe Coding? A Founder's Guide to AI-Built Prototypes
Vibe coding is building software by describing what you want to an AI tool in plain English, accepting the code it generates, and steering by feel — without reading the code itself. You type “build me a booking app with logins and a calendar,” the tool builds it, you click around, you tell it what to change. Repeat until it works.
The term comes from Andrej Karpathy, who described it in February 2025 as a style of building where you “fully give in to the vibes, embrace exponentials, and forget that the code even exists.” He meant it half as a joke about weekend projects. Eighteen months later it’s the default way founders start companies: in Y Combinator’s Winter 2025 batch, roughly a quarter of startups had codebases that were ~95% AI-generated.
We run an AI-first development agency, so this is not an anti-AI take. It’s a map of what vibe coding actually is, what it’s genuinely great at, and the exact point where it stops being the right tool.
How vibe coding works in practice
The tools — Lovable, Bolt, v0, Replit Agent — all run the same loop:
- Describe the app, or the next change, in plain English
- Generate — the AI writes and applies the code
- Test by clicking — does it look and behave right?
- Describe what’s wrong — and the loop starts again
The defining trait isn’t that AI writes the code — professional teams do that too now. It’s that nobody reads the diff. You judge the app by its behavior, not its internals. That’s what makes it fast, and it’s also the entire risk profile in one sentence.
Cost: $20–$200/month in tool subscriptions. That’s it. Which leads to the part most engineering takes on vibe coding miss.
What vibe coding is genuinely great at
Validation. Before 2025, testing whether anyone wanted your product meant $20,000+ and months of waiting. Now it’s a weekend and the cost of dinner. If you have an unvalidated idea, vibe coding is not just acceptable — it’s what we tell founders to do before hiring anyone, including us.
Investor demos. A clickable product beats a pitch deck. Plenty of rounds have been raised on vibe-coded prototypes, and that’s fine — investors are evaluating the idea and the founder, not the schema.
Being the spec. A working prototype is the best requirements document ever invented. It answers a hundred questions no written brief covers: what’s on each screen, what happens on click, what the flows actually are. When founders bring us a prototype, scoping gets faster and cheaper.
Where vibe coding breaks
AI tools reliably get you about 70% of the way to a production application. The last 30% — auth edge cases, payment failure handling, security hardening, real-world integrations, queries that survive 1,000 concurrent users — is invisible in a demo and doesn’t yield to more prompting.
The data on what lives in that gap:
- The Cloud Security Alliance reports more than 60% of AI-generated code contains security vulnerabilities.
- A May 2025 audit of Lovable-built apps found ~10% actively leaking sensitive user data (170 of 1,645 apps).
- One documented case: hardcoded AWS keys scraped within 12 minutes of deploy, $50,000+ in unauthorized compute.
- Founders who launch anyway and hit the wall report $40,000+ rescue costs.
We’ve written up the full failure data in vibe coding vs. hiring an agency, and turned the recurring audit findings into a seven-point security checklist you can run on your own app today.
The signs it’s time to stop vibe coding
Founders rarely need to be told — the app tells them. The classic symptoms:
- Every fix breaks two other things. The codebase has outgrown what prompting can safely modify.
- The tool loops on the same bug, confidently “fixing” it a dozen different ways.
- Real strangers are about to trust it with their data or their money.
- Investors want technical diligence on what you’ve built.
Any one of these means the prototype has done its job. All four mean you’re late.
What to do with your prototype (don’t throw it away)
Your vibe-coded app is not a mistake — it’s a validated spec, and that’s worth real money. The wrong move is launching it unaudited; the equally wrong move is letting an agency talk you into starting from zero as if the prototype taught you nothing.
The path we recommend: get the prototype audited — ours is a 3-day security and architecture review, $1,500, credited toward a rebuild if you need one. Sometimes the verdict is “fix these five things and ship.” More often it’s “keep the idea, rebuild the foundation” — and a fixed-price production build costs a fraction of a post-launch rescue. Either way you get the verdict in writing, and a scoping call is free.
Frequently asked questions
Is vibe coding real programming? It produces real software with a real risk profile, so yes — but it skips the parts of programming that exist to manage risk: reading code, reviewing changes, testing edge cases. For a prototype, skipping those is a feature. For production, it’s the problem.
Can a vibe-coded app go to production? Sometimes, after an audit and hardening pass. The default answer is no: with over 60% of AI-generated code containing vulnerabilities, launching unreviewed code with real user data is a gamble that fails publicly.
How much does vibe coding cost? $20–$200/month in tool subscriptions. The real cost decision comes after validation: a professional production build runs $4,995–$25,000 fixed at AI-first rates, versus $40,000+ to rescue an unaudited launch that went wrong.
Do professional developers vibe-code? They use the same AI tools — we build with Claude Code daily — but with the opposite review posture: senior engineers own the architecture and review every line before it ships. Same speed advantage, none of the unread code. That’s our entire process.
