Vibe coding: prototype to product.
Vibe coding — describing what you want to an AI tool and accepting the code it writes — is a genuinely fast way to get a working prototype. The trouble starts when that prototype gets real users, real data or real money, because the parts it tends to skip are exactly the parts that matter then.
- Published
- 22 October 2026
- From
- Kramiva
01
What vibe coding is
The term was coined by the AI researcher Andrej Karpathy in February 2025 for a style of programming where you describe the result in plain language, let a model write the code, and judge it by whether it works rather than by reading it. Collins English Dictionary made it its word of the year for 2025.
For a prototype, an internal tool or testing whether an idea has legs, this is a reasonable trade. You learn in days what used to take weeks, and if the idea fails, little is lost.
02
Where it goes wrong
Researchers at Georgia Tech's School of Cybersecurity and Privacy built a tracker, the Vibe Security Radar, that traces published vulnerabilities back to code written by AI tools. By March 2026 it had confirmed 74 cases, 14 of them critical — and 35 in March alone, more than in all of 2025. The flaws included command injection, authentication bypass and server-side request forgery. The researchers call the count a floor, because AI-written code is easy to miss once its markers are removed.
The pattern is not typos. As one of the researchers put it, an agent building something without authentication is a design gap, not a slip. The model built what it was asked for; nobody asked for the parts that keep strangers out.
03
What a prototype usually skips
These are the things to check before an AI-built app holds anything you would mind losing.
- Authentication and authorisation on every route and every database query, not just the login page
- Secrets — API keys, database passwords — kept out of the code and out of the browser
- Input validation on everything a user or another system can send
- Database access rules, so one customer can never read another customer's data
- Backups that have been restored at least once
- Error handling and logging, so failures are seen rather than silently lost
- Dependencies kept up to date, with a way to hear about security fixes
- Automated tests for the paths that matter, so a new change cannot quietly break an old one
04
Signs it is time for a review
- The app now stores personal data or takes payments
- Real customers depend on it, not just your team
- Nobody can explain how a key feature works
- Fixing one thing regularly breaks another
- More than one person — or more than one AI tool — is changing the code
05
Review first, rewrite only if needed
A vibe-coded app is not automatically a rewrite. Often the interface and much of the logic are sound, and the work is closing the gaps above: adding access control, moving secrets, writing tests around what exists. A short review tells you which case you are in before you spend money on either.
Whichever way it goes, make sure the code repository, hosting and database accounts are in your company's name. An app you cannot access is an app nobody can fix.
Related services
Sources
- Bad Vibes: AI-Generated Code is Vulnerable, Researchers Warn — Georgia Tech Research, 13 April 2026
- Vibe coding — Wikipedia
Accessed 22 October 2026. Kramiva is not affiliated with these publishers.
Tell us what you are building.
A short brief gets you a real reply from a founder within one business day — an honest read on fit, scope, and budget.