In February 2025, Andrej Karpathy posted on X about "a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists." Nine months later Collins Dictionary made it its Word of the Year. The term went from one post to the default name for building apps with AI in under a year, and it picked up a looser meaning on the way.
TL;DR
Vibe coding means building applications using AI-powered tools like Cursor, Bolt.new, Lovable, and v0. You describe what you want, and AI generates the code. It's faster than traditional coding but creates unique security challenges because the AI doesn't automatically follow security best practices.
Vibe coding is building software by describing what you want to an AI tool and accepting the code it writes, judging the result by whether the app works rather than by reading the code. In the strict sense Karpathy meant, you don't review the diffs at all. In everyday use it covers most AI-first app building, including founders on Lovable or Bolt who never open a code file.
Your Learning Path
- Start Here
- What is Vibe Coding
- Why Security Matters
- First Scan
The Rise of AI-Powered Development
Instead of writing every line of code yourself, you describe what you want and an AI tool generates it. Karpathy's original post was about throwaway weekend projects: he said he would "Accept All" on diffs without reading them and paste error messages back in until things worked.
That detail matters, because the term now gets used two ways. Simon Willison drew the line in a March 2025 post: if you reviewed the AI's code, tested it, and could explain how it works, that's software development with an AI assistant, not vibe coding. Vibe coding is building without reviewing what the model wrote. Most people now use the looser meaning, but the strict one is where the security risk lives: code nobody has read is code nobody has checked.
84% of developers use or plan to use AI tools in their development process Source: Stack Overflow Developer Survey 2025
This approach has opened software development to a much wider audience. Founders, designers, and domain experts can now build functional applications without years of coding experience. But this accessibility comes with responsibility, especially around security.
How Vibe Coding Works
The typical vibe coding workflow looks like this:
- Describe what you want: You write a prompt explaining the feature or app you want to build
- AI generates code: The tool creates code based on your description
- Review and refine: You test the output and ask for changes
- Deploy: You push your app to production
The AI handles the technical implementation while you focus on the product vision. This dramatically speeds up development, with many vibe coders shipping MVPs in hours instead of weeks.
Popular Vibe Coding Tools
Cursor
AI-powered code editor based on VS Code. Great for developers who want AI assistance while maintaining full control.
Bolt.new
Full-stack app builder that generates complete projects from prompts. Handles both frontend and backend.
Lovable
AI app builder (formerly GPT Engineer) focused on creating deployable applications from descriptions.
v0 by Vercel
UI component generator that creates React components from text or image prompts.
Replit
Online IDE with AI features for building and deploying apps directly in the browser.
GitHub Copilot
AI pair programmer that suggests code completions directly in your editor.
Vibe Coding vs Traditional Coding vs No-Code
| Aspect | Traditional Coding | Vibe Coding | No-Code |
|---|---|---|---|
| Learning curve | Steep (years) | Moderate (weeks) | Low (hours) |
| Output | Custom code | AI-generated code | Platform-specific |
| Flexibility | Unlimited | High | Limited to platform |
| Portability | Full ownership | Full ownership | Platform dependent |
| Security control | Full manual control | Requires review | Platform handles |
| Speed | Slow | Fast | Very fast |
Why Security Matters for Vibe Coders
Here's the critical thing to understand: AI tools prioritize functionality over security. When you ask an AI to build a user login system, it will create something that works. But it might not include:
- Proper password hashing
- Rate limiting to prevent brute force attacks
- Secure session management
- Input validation
- Protection against common vulnerabilities
The AI doesn't know that your app will handle real user data or that someone might try to abuse it. It just follows your instructions. This means security becomes your responsibility.
The vibe coding security gap: AI can build features in minutes, but adding security often takes longer than building the feature itself. Many vibe coders skip this step, creating apps that are technically functional but dangerously insecure.
Common Security Issues in Vibe-Coded Apps
These are the problems we see most often when scanning vibe-coded apps:
- Exposed API keys: AI often generates code with placeholder API keys that get accidentally committed
- Missing database security: Supabase and Firebase apps often lack proper Row Level Security
- No authentication on sensitive endpoints: APIs that should require login are left open
- Hardcoded secrets: Passwords, tokens, and keys embedded directly in the code
- Insecure defaults: CORS set to allow all origins, cookies without secure flags
This isn't theoretical. In 2025 a researcher checked 1,645 apps from Lovable's public showcase and found 170 with Supabase tables anyone could read, which became CVE-2025-48757. That July, SaaStr founder Jason Lemkin watched Replit's agent delete his production database during a code freeze. Neither needed a skilled attacker. Both came from trusting generated code and agent actions that nobody had checked.
Getting Started with Secure Vibe Coding
You don't need to become a security expert to build secure apps. Start with these basics:
- Use environment variables: Never put API keys or secrets directly in your code
- Enable database security: If you're using Supabase or Firebase, configure Row Level Security
- Run a security scan: Use CheckYourVibe or similar tools to find issues before users do
- Review AI-generated code: Look for hardcoded values and missing authentication
- Ask AI for help: Prompt your AI tool to add security features explicitly
What is vibe coding?
Vibe coding is building software by describing what you want to an AI tool like Cursor, Bolt.new, Lovable, or v0 and accepting the code it generates, often without reading it. Andrej Karpathy coined the term in February 2025, describing it as fully giving in to the vibes and forgetting that the code even exists.
Who coined the term vibe coding?
Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla, in a post on X in February 2025. Merriam-Webster listed it as slang and trending in March 2025, and Collins Dictionary named it its 2025 Word of the Year in November 2025.
Is vibe coding the same as no-code?
No. No-code platforms like Bubble or Webflow use visual interfaces to build apps without code. Vibe coding still produces real code (React, Next.js, etc.), but AI writes most of it based on your descriptions. The output is actual code you can customize and deploy anywhere.
Do I need coding experience for vibe coding?
Not necessarily. Many vibe coders are non-technical founders, designers, or domain experts. However, understanding basic concepts helps you communicate with AI tools more effectively and catch potential issues. Security knowledge is especially important since AI-generated code often needs security improvements.
Is AI-generated code secure?
Not by default. AI focuses on functionality, not security. It will create working code, but that code often lacks proper authentication, input validation, and security configurations. You need to review AI-generated code and add security measures yourself or use tools to identify issues.
Where to Go Next
- Recommended Next: Why Security Matters. Now that you know what vibe coding is, understand why security is critical.
- Take Action: Run Your First Scan. Ready to see your app's security state? Start with a free scan.
- Using Cursor: Cursor Security Tips. Specific guidance for securing apps built with Cursor.
New to Vibe Coding?
Scan your AI-built app for security issues in 60 seconds.