"Vibe coding" entered the vocabulary in 2025: describe what you want, let an AI coding tool write it, run it, describe the fixes, repeat, without reading the code. By 2026 the tools are good enough that non-developers are launching customer-facing apps this way, and we are now regularly asked to rescue them. This article is not an argument against AI in development; we use it every day. It is an honest account of what goes wrong when nobody who understands the code is in the loop, and how to get the speed without the damage.
What vibe coding is genuinely good at
- Prototypes: a clickable version of an idea in an afternoon, to show investors or test with customers
- Internal tools with no sensitive data: a calculator, a form that emails a sheet, a dashboard over a CSV
- Landing pages and throwaway campaign sites
- Learning: seeing how a feature could be built before commissioning it properly
If the thing can be deleted tomorrow without consequence, build it however is fastest.
Where the failures come from
Security the author never saw
The patterns we find in rescued vibe-coded apps are consistent: API keys committed to public repositories, database rules that let any logged-in user read every record, file uploads with no type checking, admin pages protected only by an unguessable URL, and payment amounts taken from the browser rather than the server. The AI did not refuse to write these; it wrote what was asked. Nobody asked for the parts that were not mentioned.
No data model, so no data
Professional development starts with what the data is and how it relates. Prompt-driven development starts with screens. The result is tables that duplicate each other, no foreign keys, dates stored as text and no migrations. It works until the first real customer load, and then reports are wrong and nobody can say which record is the true one.
Nobody can change it
A codebase assembled by a hundred prompts has no architecture. Each fix was local. Six months in, every change breaks something else, and a developer asked to add a feature quotes a rebuild because that is cheaper than understanding it.
Compliance and the app stores
Store review, DPDP consent requirements and payment gateway rules are not things an AI adds unprompted. We covered the store side in Google Play and App Store requirements in 2026; a rejected binary is the gentle outcome.
Running costs nobody budgeted
Vibe-coded apps often ship on usage-billed platforms with the AI's default settings: a serverless function polling every second, a database with no indexes, an image library storing originals at full size. The first invoice is the surprise.
What it actually costs
| Stage | Vibe-coded app | Professionally built app |
|---|---|---|
| Build | Days, near-zero cost | Weeks, a quoted project |
| First 100 users | Usually works | Works |
| First security incident | Common within the first year; often means a rebuild plus breach notification | Rare; patched, not rebuilt |
| Adding features in year two | Frequently quoted as a rewrite | Incremental |
| Total three-year cost | Often higher once the rebuild is counted | Predictable |
How professional teams use the same AI
The productivity gain is real and we take it. The difference is what sits around the AI:
- A design first: data model, roles, permissions and integrations are decided by people before any code is generated.
- AI writes, engineers review: every generated change is read by a developer who understands it, exactly as a colleague's code would be.
- Tests and static analysis: automated checks run on every change, so an AI regression is caught in minutes, not in production.
- Frameworks with guardrails: Laravel and Flutter make the secure path the default path, which is where AI-generated code is most reliable.
- Security review before release: authentication, authorisation, input handling and secrets are checked by a person against a checklist.
The outcome is roughly the speed of vibe coding on the parts that are routine, with the judgement of an engineering team on the parts that are not. Our custom software development engagements work this way, and it is why our quotes have come down over the last two years rather than up.
If you already have a vibe-coded app in production
- Rotate every credential in it today; assume some are exposed.
- Get a security review of authentication, data access rules and payments before anything else.
- Export your data in a clean format while you still can.
- Decide, with the review in hand, whether to harden or rebuild. Rebuilds on a proper stack are often faster than expected because the prototype has already settled what the product should do.
Frequently asked questions
Is AI-generated code always worse than human code?
No. Reviewed, tested AI-generated code inside a designed architecture is as good as any other. Unreviewed code of any origin is the problem.
Can I vibe-code the prototype and then hand it to a developer?
Yes, and that is a sensible use. Expect the developer to treat it as a specification rather than a foundation.
How do I know if an agency is just vibe coding my project?
Ask to see the data model, the test suite and the code review process. An agency that cannot show you all three is not doing professional development, whatever tools it uses.
Talk to us if you have an AI-built app you are not sure about. The review is quick and the answer is usually clearer than people fear.
