In 2025 the world discovered you can build software “on vibes.” Describe what you want in plain English, the AI writes the code, and by evening you have a working app. It’s called vibe coding, it was Collins Dictionary’s Word of the Year, and it has convinced a lot of people that programmers are on the way out. The reality is more interesting — and for anyone charging money for software built this way, considerably more dangerous. Here’s the honest guide.
The 60-second summary
- Vibe coding is real and it’s powerful: prototypes that took weeks now ship in hours. It’s not a fad — 25% of Y Combinator’s Winter 2025 startups ran on codebases that were 95% AI-generated.
- But it doesn’t replace the engineer — it amplifies one. AI writes code; the engineer decides architecture, security, data design and what NOT to build.
- The dark-side numbers: unsupervised AI-generated code carries vulnerabilities at 2.7x the rate of human-written code, and roughly 45% contains OWASP-catalog flaws.
- Charge money for an unengineered vibe-coded product and the risk stops being technical and becomes legal: customer data leaks, breach of contract, data-protection fines.
What vibe coding is (and where it came from)
The term was coined in February 2025 by Andrej Karpathy — OpenAI co-founder and former head of AI at Tesla — describing a way of programming where you “see stuff, say stuff, run stuff, and copy paste stuff”: you ask the AI for what you want, accept what it generates without reading too closely, and move on feel alone. Hence the “vibes.” Within months it went from Twitter joke to Merriam-Webster entry to Collins Word of the Year.
Tools like Cursor, Lovable, Bolt and Claude Code did the rest: today anyone, with zero programming knowledge, can put an app online the same day. And that, said plainly, is wonderful — for validating ideas, building demos, automating personal tasks and learning.
The thesis nobody states completely
The debate was framed wrong from day one: “will AI replace programmers?” is the wrong question. The right one is: what does the same tool produce in the hands of someone who understands what’s happening versus someone who doesn’t?
A Silicon Valley CEO summed it up in Fortune: vibe coding lets 10 engineers do the work of 100. Notice the detail: 10 engineers. Not “zero engineers.” AI multiplies what you already know; multiply by zero architecture and security knowledge and the result is still zero — except now it’s running in production, holding real customers’ data.
Same prompt, two different worlds
| Aspect | Vibe-coded without fundamentals | Vibe-coded by an engineer |
|---|---|---|
| Initial speed | Blazing | Blazing (it’s a tie here) |
| Architecture | Whatever the AI improvised that day | Designed: layers, modules, separation of concerns |
| Keys and secrets | Frequently hardcoded in client-visible code | Environment variables, rotatable, never in the repo |
| Database | No access rules; anyone with the URL can read | Row-level permissions, backups, controlled migrations |
| Error handling | Broken screens or errors leaking internals | Controlled errors, logs, alerts |
| Under growth | Crashes, or racks up huge cloud bills | Rate limits, caching, scaling planned |
| Maintenance at month 6 | Nobody understands the code — not even the AI | Documented, tested, changeable |
The 8 classic amateur vibe-coding mistakes
- Hardcoded API keys. Mistake number one. The OpenAI, Stripe or database key pasted right into browser-visible code. GitHub has detected over one billion exposed secrets in repositories — most of them live.
- Databases with no access rules. The most famous case: a 2025 CVE revealed a popular vibe-coding tool was generating databases without row-level security, exposing 170+ production applications. Another incident leaked 1.5 million session tokens and 35,000 email addresses.
- Functions that don’t talk to each other. The form “works” but doesn’t validate; the payment records but the order never updates. Everything looks fine in the demo and breaks under real use.
- SQL injection and missing validation. A crawl of 5,600 public vibe-coded apps found everything from SQL injection to exposed keys.
- No real authentication. A “login” that only hides buttons: the data is still reachable by requesting the right URL.
- Zero backups, zero environments. Editing straight in production; the day the AI “fixes” something by dropping the customers table, there’s no way back.
- Runaway cloud bills. With no rate limiting, one bot or one loop bug can burn hundreds of dollars in hours.
- Passwords and sensitive data in plain text. No encryption, no hashing — sometimes right in the logs.
The moment you charge money: legal exposure
- Customer data leaks. If your client’s app stores THEIR customers’ names, emails or payment data and a vulnerability leaks it, data-protection law kicks in — in Mexico the LFPDPPP carries fines in the millions of pesos; in the US, state privacy laws and FTC exposure follow the same logic.
- Breach of contract. If you sold “a working, secure system” and delivered something that crashes or exposes data, your client has grounds for refunds and damages. “The AI wrote it” is not a legal defense.
- Cascading liability. The business that bought the app answers to its customers — then turns around to look at whoever sold it.
- Fuzzy intellectual property. Who owns the code? What licenses ride along in dependencies the AI added silently? Serious contracts answer that in writing.
The simple rule: when third-party money or data is involved, vibe coding without engineering is a lawsuit waiting for a date.
What a real engineer adds on top of the AI
- Structure: architecture decided before the first generated line, so the system survives growth.
- Security by design: secrets out of the code, role-based permissions, input validation, encryption.
- Judgment to read the output: catching hallucinated functions, open doors, abandoned dependencies.
- Testing and verification: “looks fine” is not evidence; tests are.
- Data modeled properly: most systems that collapse do so over a badly designed database, not the code.
- Maintainability: leaving something another human (or another AI) can understand in a year.
We live this daily: at Azterion our engineers use AI coding agents on every project and the productivity jump is real. But every line goes through engineering — review, tests, standards. The AI brings the speed; the team brings the “this won’t break or expose us.”
The right workflow: vibe-code the prototype, engineer the product
- Validate on vibes: prototypes, demos, proofs of concept — vibe coding’s perfect terrain, saving weeks.
- Decide on evidence: if the idea works (real users, real money, real data), ask the adult question: rebuild on solid foundations, or harden what exists?
- Engineer before you charge: security audit, secrets out of the code, database permissions, backups, rate limits and a clear contract. Exactly the kind of work we do in custom software development.
- Maintain with discipline: software is a living thing; without updates and monitoring, even great code ages badly.
FAQ
Will vibe coding replace software engineers?
No — it’s changing the job. Hand-typing code matters less; designing systems, reviewing AI output and answering for security matters more. The teams shipping the most with AI are engineers using it, not being replaced by it.
Is it wrong for a non-programmer to vibe-code?
The opposite — there’s never been a better time to build your ideas. The healthy boundary: prototypes, personal tools and learning. Once there are clients, payments or third-party data, add engineering.
I have a vibe-coded app running. Now what?
A short audit answers the three critical questions: are secrets exposed? does the database enforce permissions? what happens if it goes down? From there you decide whether to harden or rebuild — our technology consulting practice starts exactly there, and it costs far less than your first incident.
Finding this analysis useful?
We publish guides like this whenever something big happens in AI and business technology. Leave your email and we'll let you know — no spam, promise.
Sources
- Wikipedia: Vibe coding
- Fortune: “Vibe coding lets 10 engineers do the work of 100”
- Vibe Coder: The Security Crisis in AI-Generated Code (2026)
- AquilaX: Hardcoded Secrets and API Keys
- TechTarget: Vibe coding reshapes developer jobs
Got a vibe-coded prototype that’s starting to smell like a product — or an idea you want built right from day one? Book a free 45-minute call: we’ll review your case honestly and tell you what it needs (and what it doesn’t).
