# What is vibe coding? Source: https://www.plutonapps.com/resources/what-is-vibe-coding Published 2026-09-30, updated 2026-10-24, sources checked 2026-10-24. By Milad Zarghani (https://www.plutonapps.com/authors/milad-zarghani). **Vibe coding:** Vibe coding is building software by describing what you want to an AI in plain language and accepting the code it writes, judging the result by whether it works rather than by reading the code. The term was coined by Andrej Karpathy in February 2025 and named Collins Word of the Year 2025. Also known as: Prompt-to-app, AI-assisted coding. The word for building by prompting. Useful to know exactly, because it describes how the first version gets made, not how the live one is run. ## What does vibe coding do well, and where does it stop? Vibe coding is the fastest way anyone has found to answer the first question a product has to answer: is this the right thing to build? Tools such as Lovable turn a description into screens, data and logic in minutes, and a founder can change their mind as often as they like. The same property becomes a risk once other people rely on the app. Nobody reviewed the code, so nobody knows which rules the database enforces, what happens when two requests arrive at once, or what a stranger can reach with the app's public key. None of that shows up when you click through the screens yourself. If a vibe-coded app is already live and breaking, our [vibe coding rescue](https://www.plutonapps.com/services/vibe-coding-rescue) starts with a review of what exists, then fixes what is risky. ## Where did the term vibe coding come from? Andrej Karpathy named it in a post on X in February 2025. Collins Dictionary later chose it as its Word of the Year 2025 and defines it as the use of artificial intelligence, prompted by natural language, to write computer code. The point of the word is that you stop reading the code yourself. Karpathy's own write-up of building a small app this way, MenuGen, is a useful honest account. The first local version came together quickly. The hard parts were everything around it: API keys that had to be set by hand on the host, a build that failed only in production, sign-in that needed a custom domain and Google setup, and payments that first matched users by email, which he found unreliable. ## What goes wrong most often in a vibe-coded Lovable app? The common failures sit in the backend, not on the screen. In a Lovable app on Supabase, the browser talks to the database directly with a public key, so the database rules decide what any visitor can read. If those rules are missing or too loose, the app looks fine and still leaks data. - Tables without row-level security, or with a policy that lets everyone through. Supabase's publishable key is designed to be public and reaches whatever those rules allow; see [row-level security](https://www.plutonapps.com/resources/what-is-row-level-security). - A secret key in browser code. Supabase's secret key bypasses every policy, so it must never ship to the browser. - No tests, so each new prompt can quietly break a flow that worked yesterday. - Treating Lovable's built-in scan as an audit. Lovable's own documentation says its security tools cannot guarantee complete security and do not replace a thorough review. ## How do you keep vibe coding without shipping it straight to users? Keep prompting for the product, and put an engineering step between your prompts and real users. Engineers read what was generated, add tests and access rules, and own how releases reach the live app. Your prompting stays fast, and the live system only changes after someone has checked the change. - Keep vibe coding for what it is best at: shaping the product, the screens and the flow. - Before real users arrive, have engineers read what was generated, add the tests, and decide how data, access and releases work. - Keep the two apart, so your prompting never edits the live system directly. That split is how we work: you keep prompting in Lovable, and our engineers turn each version you send into the live product. The steps are written out in [how to take a Lovable app to production](https://www.plutonapps.com/guides/lovable-app-to-production), and the free [production readiness check](https://www.plutonapps.com/tools/production-readiness-check) shows where your app stands today. ## Frequently asked questions ### Is vibe coding bad? No. It is an excellent way to explore and prototype, and it lets a founder test an idea in days. The risk is shipping what it produces to real users without anyone reading, testing or securing it. Keep prompting for the product, and have engineers review the code before launch. ### Can a vibe-coded app go to production? Yes, once engineers have reviewed and hardened it: access rules in the database, tests, a staging environment, monitoring and a way to release and roll back. Until then, nobody knows what a stranger can reach with the app's public key, or whether the next prompt breaks a working flow. ### Who coined the term vibe coding? Andrej Karpathy, in a post on X in February 2025. His later write-up of building MenuGen this way shows both the speed and the hard parts. Collins Dictionary named vibe coding its Word of the Year 2025, defining it as using AI prompted by natural language to write code. ### Is vibe coding the same as using an AI coding assistant? Not quite. With an assistant, a developer still reads, edits and owns each change the AI suggests. Vibe coding means accepting the generated code and judging it only by whether the app works. The same tools can be used either way; the difference is whether anyone reviews the code. ## Read next - [How to make a Lovable app production-ready](https://www.plutonapps.com/guides/lovable-app-to-production) - [The Bell case study: an assistant designed in Lovable, rebuilt for production](https://www.plutonapps.com/work/bell) - [Plans and pricing](https://www.plutonapps.com/pricing) ## Sources - [Collins Dictionary: Word of the Year 2025 (November 6, 2025)](https://blog.collinsdictionary.com/language-lovers/collins-word-of-the-year-2025-ai-meets-authenticity-as-society-shifts/) - [Andrej Karpathy on X: the post that named vibe coding (February 2, 2025)](https://x.com/karpathy/status/1886192184808149383) - [Andrej Karpathy: Vibe coding MenuGen (April 27, 2025)](https://karpathy.bearblog.dev/vibe-coding-menugen/) - [Lovable documentation: Security](https://docs.lovable.dev/features/security) - [Supabase documentation: API keys](https://supabase.com/docs/guides/api/api-keys)