Vibe coding means building an application by talking to an AI rather than writing the code by hand. You describe the screen, the feature or the bug, the tool produces the code, you look at the result and you adjust. Lovable, Bolt, v0, Replit and Base44 have made it accessible to people who have never programmed.
Where the term comes from
Andrej Karpathy, AI researcher and OpenAI co-founder, coined the expression on February 2, 2025. He described a way of coding where you "fully give in to the vibes" and "forget that the code even exists". The term caught on within weeks: Merriam-Webster added it to its trending expressions in March 2025, and Collins named it its Word of the Year 2025.
The word now has two uses. In the strict sense, it means the practice of not reading the code. In the broad sense, it covers any app built mainly by conversing with an AI, including when a developer reviews it afterwards.
What vibe coding does very well
Reducing it to a gimmick would be wrong. It genuinely changes how a product gets started:
- Speed of the first version. A clickable prototype takes a few hours, sometimes an afternoon, where it used to take several weeks
- Direct access for domain experts. The person who knows the problem builds the solution, without translating needs into a specification
- Validation before investment. You can show an app to real customers, measure interest and then decide where to invest
- A real codebase. Most platforms produce standard code (React, TypeScript, PostgreSQL) that a developer can take over. Our guide on exporting and owning the code explains what leaves with the repository and what stays tied to the service
What the demo does not show
A demo answers the question "does it work?". Production raises other questions that the interface does not reveal:
- Who can read which data? An overly broad access rule is invisible on screen. On Supabase, that is the job of Row Level Security
- Where are the secrets? A payment or email key pasted into browser code works, and any visitor can read it
- Who owns the accounts? Domain, database, hosting, email service: everything should be in the company's name, not a contractor's or a personal account
- Can you roll back? Backups, Git history, a test environment
- Can a developer take over the code? Structure, tests, documentation and the consistency of files generated over many iterations
Published studies point the same way. In October 2025, Veracode observed that models generate increasingly functional code, without matching progress on security. That does not disqualify the method: it shows where to put the checks.
A concrete example
A consultant builds a client portal with Lovable: document uploads, messaging, invoicing. Three weeks later, she has ten active clients. A large account then sends a security questionnaire before signing.
The questions cover data location, access rights, backups and account ownership. None of it is visible in the app. A review shows that most of it holds up, with four points to fix: two overly broad access rules, an exposed email key and a domain still registered to a freelancer. The fixes take a few days, without rebuilding the app.
Vibe coding and AI-assisted development
Both use the same tools. The difference lies in accountability. In pure vibe coding, nobody reviews the code. In AI-assisted development, an engineer uses Claude Code, Codex, Cursor or Antigravity, but reviews, tests, versions and remains accountable for what goes live. That is how KERN-IT works, and it is also the natural path of a project that succeeds. For a repository produced with a coding agent, the Takeover Index measures exactly that ability to be taken over.
When to have a vibe-coded app checked
The right moment comes before a step that raises the stakes: first paying customers, sensitive data, fundraising, an enterprise client or a handover to a developer. Our article on when to audit an AI app lists six concrete signals. The vibebusters Scan then examines the code, the configuration and the services actually in use, within 72 working hours.