Build an app by describing it.
Vibe coding means building software by telling an AI what you want, without reading the code. It’s great for small personal projects — and risky the moment real people’s data is involved.
Checked Oct 2, 2026
Vibe coding is fine for personal projects and prototypes. Start free with Claude artifacts or a browser builder, save a checkpoint after every working step, and run the security checks before real people’s data goes anywhere near it.
What is vibe coding? Where the name came from
AI researcher Andrej Karpathy coined “vibe coding” on February 2, 2025, describing it as fine for “throwaway weekend projects”. Programmer Simon Willison drew the useful line: if you review, test and can explain the code, it isn’t vibe coding any more — it’s software development. Collins Dictionary made it the 2025 Word of the Year. Professionals are wary: in Stack Overflow’s 2025 survey, only about 12% of developers said they vibe code at work.
Your first app, in eight steps
Check the steps off as you go; your progress stays in this browser.
- Write a short briefWho it’s for, 3–5 screens, and what information it keeps. A tight brief gets better results.
- Build with fake data firstAsk for the screens with made-up sample data. One change per message.
- Save a checkpoint after each working stepClick through and test. Replit and Lovable can roll back to any checkpoint.
- Stuck after 2–3 fixes? Roll backGo back to the last working version and ask more narrowly. Endless fix loops burn credits.
- Add logins and a database only when neededThen set the database access rules. Missing rules caused most real leaks.
- Keep secret keys secretPut API keys in the platform’s Secrets store, never in the page.
- Run the security scanFix anything serious before you share the link. Scans can’t catch everything.
- Keep test and real data apartNever give an AI agent access to the live database.
Which tool?
| Tool | What it is | Free plan | Note |
|---|---|---|---|
| Claude artifacts | Inside a chat | Yes, on Claude Free | The easiest first try; nothing to set up |
| Lovable | Builds in your browser | 5 credits a day (max 30 a month) | 50% off for students and teachers |
| Bolt | Builds in your browser | 300K tokens a day, hosting included | |
| v0 (Vercel) | Builds in your browser | 7 messages a day | |
| Replit | Browser + hosting | 1 published app (expires after 30 days) | One-click checkpoints |
| Google AI Studio Build | Builds in your browser | Free allowance | |
| Cursor | AI code editor | Hobby (limited) | Now owned by SpaceX |
| Devin Desktop | AI code editor | Small free allowance | Formerly Windsurf |
| GitHub Copilot | Helper in your editor | 2,000 completions a month | |
| OpenAI Codex | Coding agent | Included with every ChatGPT plan | |
| Gemini CLI | Terminal agent | 1,000 requests a day | Open source |
| Claude Code | Terminal / desktop agent | Not on the free plan |
Free allowances from each company’s pricing page, checked Oct 2, 2026. What the paid plans cost is on our AI Tools comparison.
What’s gone wrong for real
| When | Who | What happened | Root cause |
|---|---|---|---|
| Mar–May 2025 | Lovable | 170 of 1,645 scanned apps (about 10%) leaked emails, addresses, payment details and keys. | Missing database access rules |
| Jul 2025 | Base44 | A public app ID let anyone log into private apps. Fixed in under 24 hours. | Platform login flaw |
| Jul 2025 | Replit / SaaStr | During a code freeze the agent deleted a live database of 1,200+ records, then made up data. The data was later recovered. | Agent had access to live data |
| Jan–Feb 2026 | Moltbook | A key left in the web page exposed 1.5M API tokens and 35,000 emails. The founder had written no code himself. | Exposed key, no access rules |
| Apr 2026 | PocketOS | A coding agent used an over-powered key and deleted the live database and backups in about 9 seconds. | Too much access |
Three of these five come down to one mistake: a database that anyone could read because its access rules were missing. Security firm Veracode found that AI-written code failed security tests 45% of the time in 2025, and the pass rate barely moved in 2026 (55% to 56%).
Sources: Karpathy · Simon Willison · Stack Overflow survey · Lovable security docs · Replit checkpoints · CVE-2025-48757 · Wiz on Base44 · The Register on Replit · Wiz on Moltbook · The New Stack on PocketOS · Veracode
Guides in this section
Quick answers
What is vibe coding?
Building software by describing what you want to an AI and accepting its code without reading it. Andrej Karpathy coined the term on February 2, 2025; Collins Dictionary made it the 2025 Word of the Year.
Is vibe coding free?
You can start free: Claude artifacts work on Claude’s free plan, Bolt and Lovable have daily free allowances, and Gemini CLI gives 1,000 free requests a day. Most also have paid plans, usually metered — see the prices on our AI Tools comparison.
Which vibe coding tool is best for beginners?
Start inside a chat with Claude artifacts — nothing to set up. When you want a real web app with logins and a database, browser builders like Lovable, Bolt, v0 or Replit are the next step. Coding agents like Claude Code and Codex suit people who can already read code.
Is it okay to vibe code a website?
Yes for a site that only shows information. Once it stores visitors’ data, has logins or takes payments, run the security checks first. Is vibe coding safe?
Is vibe coding bad?
No — it’s great for prototypes and personal tools. It’s risky for anything holding other people’s private data, because AI-written code failed security tests 45% of the time in Veracode’s 2025 study.