Is Vibe Coding Bad? An Honest Answer for Founders
Garrett Pierson
Vibe coding isn’t bad. Shipping AI-written code you never read — for an app that touches real money or real user data — is where people get burned.
If you’ve watched someone on X build an app in a weekend and then watched someone else roast “vibe-coded slop” in the replies, you’re right to wonder which one is true. The honest answer is: both. Vibe coding is a genuinely good way to get from idea to working product. It’s also a fast way to ship a security hole if you skip the two or three things that keep AI-written code safe. This post walks through exactly where the bad reputation comes from, when it’s earned, and how to build without becoming a cautionary tale.
Where the “vibe coding is bad” reputation comes from
The criticism is grounded in real data.
- AI introduced a known security flaw in 45% of the tasks Veracode tested. Veracode’s 2025 GenAI Code Security Report ran more than 100 large language models through security-relevant coding tasks across Java, JavaScript, Python, and C#. Only 55% of those tasks produced secure code — the other 45% introduced a known vulnerability. And bigger, newer models didn’t score better.
- AI makes people more confident and less correct. A Stanford study, “Do Users Write More Insecure Code with AI Assistants?”, found that people using an AI assistant wrote measurably less secure code than those without one — while being more likely to believe their code was secure. That gap between feeling safe and being safe is the whole problem in one sentence.
- The code gets messier over time. GitClear analyzed 211 million changed lines of code from 2020 to 2024. Over the stretch when AI assistants went mainstream, refactoring fell from 25% of changes in 2021 to under 10% in 2024, while copy-pasted code rose from 8.3% to 12.3%. That’s “slop” in one metric — more duplication, less cleanup.
AI can write good code. The catch is that it writes code that looks finished before it is finished — and if nobody checks, the gaps ship.
What actually goes wrong
When a vibe-coded app fails, it’s almost never a mysterious, sophisticated attack. It’s the boring stuff:
- Secrets left in the code. API keys or passwords hard-coded into a file instead of stored as environment variables, so anyone who views the source can drain your accounts.
- No real permission checks. The app checks that you’re logged in but not that the thing you’re asking for is yours — so changing a number in the URL loads someone else’s data.
- Unfiltered inputs. A form field that passes whatever you type straight into the database, which is the front door for the oldest attack on the internet.
Founders have publicly shared apps that got hacked within days of launch — accounts taken over, data exposed, subscriptions bypassed — and the pattern is always the same: the builder assumed the AI handled security because the app worked. Working and safe are not the same test.
The part nobody admits: it’s usually not the AI’s fault
Here’s the honest core of it. The tools mostly do their job. What goes wrong is how people use them. Andrej Karpathy, who coined “vibe coding” in February 2025 (Collins Dictionary made it Word of the Year that November), described it as fully giving in to the vibes and forgetting the code exists. That’s a fantastic way to prototype. It’s a terrible way to run a checkout page.
The danger is narrow and specific: writing code with AI, never reading a line of it, and pointing it at your customers’ credit cards on launch day. The best mental model we’ve found: treat AI like a brilliant, fast junior developer who has never been told your security rules. You’d never let that person push straight to production unreviewed. Same rule here.
When vibe coding is totally fine — and when it’s genuinely risky
The better question is “what am I building?” — because the risk scales directly with what your app touches.
| Vibe code freely | Slow down and review carefully |
|---|---|
| A prototype to test an idea | Anything storing passwords or personal data |
| An internal tool only you use | Anything that takes payments |
| A landing page or portfolio site | Anything with user accounts and logins |
| A weekend project or MVP demo | Anything handling health, legal, or financial info |
If you’re in the left column, ship fast and don’t overthink it — that’s exactly what vibe coding is for. If you’re in the right column, the AI still does 90% of the work; you just add a review step before real people trust it with real information.
How to vibe code without becoming a horror story
You don’t need to learn to code to avoid the common disasters. Three habits catch most of them:
- Ask the AI to secure it, explicitly. “Store all keys as environment variables, add permission checks so users can only see their own data, and sanitize every input.” AI is good at this when you ask. It just won’t volunteer it.
- Run the three-minute safety check. Search your code for any key or password sitting in a file. Try to open every page while logged out. Type a single quote character
'into every form field and see if anything breaks. That catches the majority of what gets apps hacked. - Match the tool to the job. Some vibe coding tools handle security and hosting for you; others hand you raw code. Knowing the difference matters more than which brand you pick.
New to the whole thing? Start with what vibe coding actually is, then follow our step-by-step guide to vibe coding — the same loop, with the safety steps built in.
The bottom line
Vibe coding is bad the same way a power tool is bad: only if you skip the guard and point it at something that matters. Used well, it collapses the distance between “I have an idea” and “I have a product” from years to weeks — and the review habits that keep it safe take minutes, not a computer-science degree. That whole journey, from a safe first build to an actual business, is what Software Secrets 2.0 was written to walk you through, and the entire book is free.