Vibe Coding Explained: Meaning, Tools and Limits

Vibe coding is a way of building software in which a person describes what they want in plain language and an AI tool writes, runs and fixes the code, with the person steering by results rather than by reading every line. The term was coined by Andrej Karpathy in a post on X dated 2 February 2025, and Collins named it its Word of the Year for 2025 on 6 November 2025. This page explains what the term means, where it came from, how the workflow runs, which kinds of tools people use for it, and where the approach stops being enough. It is written for learners, product people and engineers who want a factual reference, and it adds the security and identity points that matter once vibe-coded software touches real data.

Last checked: 2026-11-15. Tools are listed alphabetically; order is not a ranking.

This is an independent reference page from NHI Mgmt Group based on public provider documentation; it is not sponsored or endorsed by any provider.

Key takeaways

A dictionary word since 2025. Merriam-Webster lists vibe coding as jargon for writing code with AI assistance in a somewhat careless fashion; Collins defines it as using AI prompted by natural language to write computer code.
Two modes, one name. Google Cloud separates "pure" vibe coding, where the user trusts the output, from responsible AI-assisted development, where the user reviews, tests and owns the code.
Tools fall into two families. Browser app builders generate and host whole apps from a prompt; coding agents work inside an existing repository from a terminal, IDE, desktop app or cloud session.
Prototype speed, production gaps. Veracode's October 2025 update reports that AI-generated code introduced risky security flaws in 45% of its tests across more than 100 models.
Secrets and identities are the usual weak point. Generated apps often hold database keys, API keys and OAuth clients, so the controls that matter most are secret handling, access policies and review before anything is published.

What does vibe coding mean?

The phrase describes a style of work, not a product. The table sets out how the main reference sources define it, as of 15 November 2026.

Source	Definition as published	Date
Collins Dictionary blog	The use of artificial intelligence prompted by natural language to write computer code; named Collins Word of the Year 2025	6 November 2025
Google Cloud	A practice where you describe what you want in plain language and an AI assistant generates, refines and debugs the code, so your role shifts to guiding the AI	Checked 15 November 2026
Merriam-Webster (slang and trending)	Writing computer code in a somewhat careless fashion, with AI assistance; the coder does not need to understand how the output works and should expect bugs; classed as more jargon than slang	Checked 15 November 2026

All three sources credit Andrej Karpathy with coining the term. Merriam-Webster cites his post of 2 February 2025, in which he described a new kind of coding where you fully give in to the vibes. Merriam-Webster also notes that the meaning may shift as use widens, and in practice people now apply the label to almost any prompt-driven coding, including careful, reviewed work that Karpathy's original description did not cover.

Vibe coding versus AI-assisted development

The useful distinction is how much the human reads and owns. Google Cloud describes "pure" vibe coding as fully trusting the output, suited to rapid ideation and throwaway weekend projects, and responsible AI-assisted development as treating the AI as a pair programmer whose code the user reviews, tests and understands.

Dimension	Pure vibe coding	Reviewed AI-assisted development
Who reads the code	Mostly nobody; the person judges by whether the app appears to work	A person reviews diffs before they are merged or published
Typical output	Prototype, demo, personal tool, landing page	Features in a maintained codebase, production services
Testing	Click through the result	Automated tests, code review, security scanning in CI
Ownership of defects	Unclear; the author may not understand the code	The engineer or team that merged it
Fit for real user data	Not without review	Yes, subject to the organisation's normal controls

How does vibe coding work?

Google Cloud describes two loops. The code-level loop is: describe a goal, let the AI generate code, run it, give feedback such as "add error handling for when the file is not found", and repeat. The application loop runs from a single high-level prompt through generation of the interface, back end and file structure, iterative refinement, human testing and validation, and deployment, which Google calls "vibe deploying".

Describe the outcome: state what the app or change should do, for whom, and any constraints (framework, data source, look and feel).
Plan before code: several tools offer a plan step. Replit Agent's Plan mode maps a task list for review before it changes code or data, and Bolt's help centre recommends Plan Mode to discuss an idea before any code is written.
Generate and run: the tool writes files, installs packages and starts the app or test suite.
Feed back results: paste errors, describe what looks wrong, or attach a screenshot; the tool edits and reruns.
Checkpoint: keep a way back. Replit Agent creates checkpoints you can roll back to, and Cursor Agent saves local snapshots before significant changes, separate from Git.
Review and publish: read the diff, run tests and scans, then publish to a URL, open a pull request, or sync to a Git host.

Which tools are used for vibe coding?

The tools below are documented by their providers as building or changing software from natural-language instructions. Fields are identical for each; where a provider page fetched for this page does not state a field, it says so. As of 15 November 2026.

Tool	Provider	Form	What the official docs describe	Output goes to
Bolt	Bolt (bolt.new)	Browser app builder	Builds websites and apps from prompts, with Plan Mode, version history and Bolt Database	Publish to a live site; connect an existing domain
Claude Code	Anthropic	Coding agent (terminal, VS Code, JetBrains, desktop app, web)	Reads a codebase, edits files, runs commands and works with git, including commits and pull requests	Local repository, branches and pull requests
Codex	OpenAI	Coding agent (CLI, IDE extension, desktop app, Codex Web)	Codex CLI is a coding agent that runs locally; Codex Web is the cloud-based agent	Local repository or cloud task
Cursor Agent	Cursor (Anysphere)	Agent inside the Cursor editor	Searches and edits files, runs shell commands, controls a browser for testing, saves checkpoints	Local repository
Google AI Studio	Google	Browser app builder	Turns an idea into a shareable web app, often from a single prompt	Deployment to Cloud Run
Lovable	Lovable	Browser app builder	Generates web apps with front end, back end, database, authentication and integrations from a description	Publish to a live URL; Git sync to GitHub, GitLab or Bitbucket
Replit Agent	Replit	Agent in the Replit Project Editor	Sets up the project, writes code, configures infrastructure such as databases, and tests the result	Replit project; deployment details not stated on the page fetched
v0	Vercel	Browser app builder and agent	Builds code, full-stack apps and agents; names Next.js, Tailwind and shadcn/ui	One-click deploy to Vercel infrastructure or a pull request

Google Cloud also names Google Antigravity for directing agents across a desktop app, CLI and IDEs, and the Agent Development Kit for building multi-agent systems; these sit at the engineering end of the range.

App builders or coding agents: how to choose

Starting point: no code yet and you want a working web app to show people, an app builder fits; an existing repository with tests and CI, a coding agent fits.
Where code and data live: app builders host the project and often the database on the provider's platform; coding agents work on your machine or in a cloud session against your Git host.
Exit path: check that the code can leave the platform (Git sync, pull requests, export) before you build anything you intend to keep.
Review surface: coding agents show diffs and integrate with pull requests; app builders show the running app first, so add a step to inspect the generated code and settings.
Team controls: check the provider's documentation for workspace administration, audit logs and two-factor sign-in. Lovable's introduction page lists a Security center, sensitive data scanning, audit logs and 2FA, for example; compare the equivalent pages for any tool you shortlist.

What are the limits of vibe coding?

Google Cloud states the main limits plainly: simple prototypes and landing pages are easy, but edge cases, complex bugs and security requirements still need an understanding of logic and troubleshooting, maintainability depends on output quality and review, and traditional programming skills still matter for production software.

Limit	What happens	What to do about it
Insecure defaults in generated code	Veracode reports risky flaws in 45% of tests (October 2025 update, Java, JavaScript, Python and C#); it also found larger, newer models did not produce more secure code	Run static analysis and dependency scanning on every change, not only at release
Hard-coded secrets	Keys pasted into prompts end up in source files, front-end bundles or commit history	Use the platform's secrets store or environment variables and turn on push protection. See the Git Secret Scanning Guide.
Open data access	A generated back end ships with permissive database rules or a privileged key in the browser	Review row-level or equivalent access rules before publishing. See the Supabase Keys Security Guide for one common pattern.
Invented or risky packages	The model suggests a dependency that does not exist or is a lookalike	Pin and verify every new dependency. See the Slopsquatting and Package Hallucination Guide.
Agent actions beyond the code	An agent with shell or database access runs a destructive command	Keep approvals on for commands, separate development and production credentials, and use checkpoints
Instructions hidden in content	A README, issue or web page tells the agent to do something else	Treat fetched content as untrusted. See the Prompt Injection Guide.
Maintainability	Nobody on the team understands the code when it breaks months later	Require a named owner and a readable test suite before an app moves past prototype

Where identity and secrets fit

A vibe-coded app is rarely just code. To work, it usually holds a database connection string, a payment or email API key, an OAuth client for sign-in, and the token the coding tool uses to push to Git or deploy. Each is a non-human identity with its own permissions. The common pattern is that these credentials are created quickly during the build, given broad scopes so that the demo works, and never rotated or removed when the prototype becomes something people rely on.

Inventory: list every key, token and service account the app and the tool use, with owner and scope.
Least privilege: give the coding agent a repository-scoped token, not an organisation-wide one, and keep production credentials out of the agent's environment.
Spend and abuse limits: put limits on any LLM API key the app calls. See How to set spend limits on LLM API keys.
Agent permissions: the AI Coding Agents Security Guide covers command approval, sandboxing and repository access for agents in depth.

How do you take a vibe-coded app to production?

Move the code under version control you control (Git sync, pull request or export) and protect the main branch.
Read the generated configuration first: authentication settings, database access rules, CORS, environment variables and any keys in front-end code.
Add tests for the core user journeys and for access rules (a signed-out user and a second user must not see the first user's data).
Turn on scanning: secret scanning with push protection, static analysis and dependency checks in CI.
Rotate every credential that appeared in a prompt, chat history or commit during the build, and store replacements in a secrets manager.
Assign an owner for the app and for each credential, and set a review date.
Roll out in stages: internal users first, then wider access, with logging on authentication and data access. Keep the last good checkpoint or release so you can roll back.

How do you measure whether it is working?

Secrets found per 1,000 commits in AI-assisted repositories, trending down.
Share of AI-generated changes merged through review, with a target of all changes for anything handling user data.
High-severity static analysis findings open longer than 30 days in vibe-coded apps.
Credentials with a named owner and rotation date, as a percentage of all credentials the apps use.
Prototypes promoted to production without the checklist, which should be zero.

Is vibe coding the same as using an AI coding assistant?

Not exactly. An AI coding assistant can be used with full review, which most definitions would not call vibe coding in Karpathy's original sense, while an autonomous agent can be used in a careless, accept-everything way, which they would. The term describes the human's level of trust and attention more than the tool. The AI Coding Assistants vs Autonomous Coding Agents page sets out the tool categories.

Common failure patterns

Publishing the prototype: a demo built with test keys and open database rules is shared publicly and starts collecting real sign-ups.
Secrets in prompts: a key pasted into chat to "make it work" is written into a file and committed.
One credential for everything: the agent, the app and the deployment share a single admin token, so one leak exposes all three.
No exit path: the app grows on a hosted builder without Git sync, so there is no review history or rollback outside the platform.
Trusting a green screen: the app looks correct in the browser while authorisation checks are missing on the API behind it.

Practitioner checklist

Decide, per project, whether it is a throwaway prototype or software that will hold real data, and write that down.
Keep generated code in a Git repository you control, with branch protection.
Use the platform's secrets store; never paste production keys into prompts.
Review database access rules and authentication settings before publishing.
Run secret scanning, static analysis and dependency checks on every change.
Scope coding-agent tokens to one repository and keep command approval on.
Rotate any credential exposed during the build and record an owner for each.
Keep a checkpoint or release you can roll back to.

Vibe Coding Explained: What It Means, Tools and Real Limits