Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

Vibe coding tools

What is vibe coding?

Vibe coding means building software by describing what you want to an AI and accepting the code it writes. Where the term came from and what it misses.

Vibe coding is building software by describing what you want to an AI tool in plain language and letting it write the code, often without reading every line. The term was popularized by AI researcher Andrej Karpathy in February 2025. It makes prototypes very fast, but security, accessibility, SEO and edge cases are easy to miss unless someone checks them.

Published · Last updated

By Michal Měřínský. Audit methodology.

What vibe coding means

In early 2025 Andrej Karpathy described a way of programming where you fully give in to the vibes: you talk to the AI, accept its changes, paste error messages back in and mostly forget the code exists. The phrase spread quickly and now covers a range of practice, from non-programmers building whole apps in an AI app builder to developers delegating large tasks to coding agents.

Developers often draw a line between vibe coding, where the code is accepted without review, and AI-assisted programming, where a person still reads, tests and understands what ships.

How it works in practice

  • App builders, such as Lovable, Bolt, v0, Base44 and Replit, generate a running web app with a database and hosting from a prompt.
  • AI code editors, such as Cursor and Devin Desktop, formerly Windsurf, edit a codebase you can see.
  • Coding agents, such as Claude Code and Codex, run in a terminal or the cloud, read a repository, make changes and run commands.
  • Backend services, such as Supabase, provide the database and login that generated apps rely on.

What it is good at

  • Prototypes, internal tools and demos in hours instead of weeks.
  • Letting people without a developer test an idea with real users.
  • Removing boilerplate for experienced developers.

What it tends to miss

  • Security: secret keys in frontend code, databases without row level security, endpoints that trust the browser.
  • Search visibility: single-page apps with one title for every route and content that only exists after JavaScript runs.
  • Accessibility: clickable elements that are not buttons, missing labels and alt text.
  • Legal basics: privacy policy, cookie consent and terms.
  • Edge cases: empty states, slow networks, errors from third-party APIs.
  • Cost controls: AI features with no rate limits or spending caps.

The AI writes code that works when you click through it. The problems show up when strangers, crawlers and attackers use it differently.

Shipping a vibe-coded app responsibly

  • Ask the tool to explain how each endpoint checks permissions, then test logged out and as a second user.
  • Move every secret to the server and search the built JavaScript for keys.
  • Check titles, descriptions and served HTML for each important route.
  • Run an automated audit before launch and after each larger change.
  • Keep the project in Git, so you can see and undo what the AI changed.

What a scan can and cannot tell you

WebAuditOS checks a vibe-coded site the way a visitor, crawler and attacker see it from outside: security headers, cookie flags, served versus rendered content, duplicate titles, legal links, console errors and more, with evidence for each finding.

It cannot read your generated code, check your database rules or detect secret keys in your bundle. Those need a code review and the tools your backend provides.

Vibe coding moves fast. A scan after each release is the cheapest way to see what the speed left behind.

Short answers

Who coined vibe coding? Andrej Karpathy popularized it in February 2025.

Is vibe coding real programming? It produces real software. Whether anyone understands that software is the open question.

Is vibe coding safe for production? Only with review and testing of security, data access and costs.

What are the best vibe coding tools? It depends on the goal. See our overview of app builders, editors and agents.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

Vibe coding tools

What are the best vibe coding tools?

The main vibe coding tools in November 2026, grouped by what they do: app builders, AI code editors, coding agents and backends, and who each suits.

Security

How do you secure a website?

The security basics every website needs, in order: HTTPS, updates, authentication, secrets, headers, backups and monitoring.