Contents
In short. Vibe coding means building software by describing the task to an AI assistant without checking the code it writes; Andrej Karpathy introduced the term in February 2025. It fits jobs where a mistake is cheap and no one else's data or money is involved: internal reports, calculators, prototypes. Anything that stores customers' personal data, takes payments or serves many users should go to a developer first. Studies are cautious: check AI code and measure time savings instead of feeling them.
What vibe coding is and where the term came from
Building software with an LLM without reviewing the code it writes
Andrej Karpathy introduced the term in a post on X in February 2025. He described a style where you "fully give in to the vibes, embrace exponentials, and forget that the code even exists": click accept all, stop reading the diffs, paste errors back to the AI. He called it not too bad for throwaway weekend projects.
In March 2025 Simon Willison objected to calling any AI-assisted code by that name. In his definition, vibe coding means building software with an LLM without reviewing the code it writes. Code you reviewed, tested and can explain is ordinary software development.
A year later, on 4 February 2026, Karpathy wrote that working with AI agents was becoming a default for professionals, with more oversight, and proposed the name agentic engineering for it.
What to build yourself and what to hand to a freelancer or team
Four questions decide it: who uses the tool, what data is inside, what a mistake costs and how long it will live. This is an editorial scheme, not an industry standard, and it does not replace a specialist review.
Disclosure: this journal is published by a project connected to WEBNOSTRA, a marketing company that offers AI implementation and automation services. Read the last two columns with that in mind and compare several providers.
Read the table by rows and follow the strictest: if the data row calls for a team, the task goes to a team.
Scroll right to see all columns
| Criterion | Build it yourself with AI | Freelancer or small studio | Development team |
|---|---|---|---|
| Who uses it | You and 1-3 colleagues | Staff, some customers | A public service with many users |
| What data | Working data, no personal data | Some personal data, reviewed | Personal data, payments, contract duties |
| Cost of a mistake | An extra hour of manual work | Lost leads, damaged reputation | Fines, a breach, stopped sales |
| Lifespan | Weeks or months | A year or more, with changes | Years, with ongoing development |
| Who fixes it | You, with the same AI | The contractor under a support deal | An in-house team or a vendor |
| Check before launch | Test on a data copy, manual reconciliation | A specialist reads code and tests access | Tests, review, monitoring, backups |
- Build yourself: a report or calculation from an export you may open anyway; a team calculator sheet; a one-off script to rename files or reconcile lists.
- Build yourself, with care: a prototype for a contractor; a page with no forms or stored data.
- Not alone: anything that takes payments or stores personal data of customers or staff.
- Not alone: a service for many users, and permissions deciding who sees what.
What people build with: tools per their documentation
Examples from official documentation checked on 3 November 2026; not a ranking or a recommendation.
- Claude Code (Anthropic): per its documentation, an agentic coding tool that reads a codebase, edits files and runs commands; terminal, IDE, desktop app and browser.
- Lovable: a platform that builds web apps from descriptions; the code can sync to GitHub, GitLab or Bitbucket.
- Replit Agent: builds a project from plain language, sets up databases, publishes; its documentation says the agent tests its own work and creates rollback checkpoints.
What to check before paying: country, price, exit
Availability: each vendor has its own country list. Anthropic's Supported Regions Policy (page metadata: effective Nov 12, 2026) says its products are available only in listed countries and regions. Read the list and terms before paying; we do not discuss workarounds.
Price: Anthropic notes that prices and plans may change at its discretion, so read the pricing page on the day you buy. Exit: check whether you can take your code out (Lovable syncs to Git hosts); otherwise the project is tied to one tool.
Does AI make the work faster: what measurements showed
The feeling of speed and the measurement can diverge
METR, a research organization, published a randomized trial in July 2025: 16 experienced open-source developers did 246 tasks in their own large repositories, each task randomly allowing or banning AI. With AI, tasks took 19% longer. Developers had expected a 24% speedup and afterwards believed AI had sped them up by 20%.
The conclusion is narrow: participants had known their projects for years, and the authors say it does not show a slowdown for most developers or in other settings. In February 2026 METR re-ran the measurement with 57 developers: speedups of 18% and 4% in two groups, intervals including zero; METR itself called the data only very weak evidence of the size of the gain.
We found no measurements for owners building small tools. In the 2025 Stack Overflow survey (49,009 self-selected responses) 77.5% said vibe coding is not part of their professional work, 15.1% said it is. The lesson: the feeling of speed and the measurement can diverge, so count hours on your own task.
How safe is AI-written code: what is known and what is not
Veracode, an application security company, tested over 100 models in 2025 on 80 code-completion tasks in Java, Python, C# and JavaScript, scored by static analysis. About 45% of tests ended in code with a vulnerability from the OWASP Top 10; for Java, 72%. Limits: these are code fragments, not finished apps, and we did not read the full report, which sits behind a form.
A controlled study by Perry and co-authors (paper from 2022, 47 participants, five tasks, an assistant on codex-davinci-002) found that people with an AI assistant wrote less secure code and more often believed it was secure. The sample is small, mostly students.
A typical hole is data access. Supabase documentation says a table without row level security is readable and writable by any role with grants, and a secret key must never be used in a browser. OWASP Top 10:2025 lists broken access control first.
In 2025 researcher Matt Palmer (who works at Replit, a similar service) reported that 170 of 1,645 checked sites built with Lovable had publicly reachable database endpoints with inadequate row level security; only home pages were checked. The CVE-2025-48757 record is tagged disputed: the supplier says each customer is responsible for its own app's data. Checking access is your job.
What to check before launching a tool that touches customer data
Save this table and send it to your contractor. The GDPR is quoted as an example, as of 3 November 2026; whether it or another law applies depends on where your customers are, a question for a lawyer.
If customer data goes to a vendor abroad, including an AI tool, rules on international transfers may apply, so do not paste data into a tool until you know where it goes.
Scroll right to see all columns
| Check | What to do | How to confirm |
|---|---|---|
| What data | List every field you collect and why; drop the rest (FTC: keep only what you need) | A field list with purposes |
| Vendors | Know which vendors (AI tool, host, database) get customer data; put security expectations in contracts (FTC) | A vendor list with terms on file |
| Safeguards and a reviewer | GDPR Art. 32: measures appropriate to the risk, such as encryption and regular testing; someone who reads code reviews it | A written list and findings |
| Access and keys | Log in as a test user and try to open another user's record; keep secret keys out of code and browser | Others' data stays closed; no keys in code |
| Payments | Do not take card numbers on your server; use the provider's hosted page (Stripe: direct handling can mean 300+ PCI DSS controls) | Card numbers skip your server |
| Backups and rollback | Turn on backups and versions; restore them on a test | Data and last version restored within an hour |
| Breach | Name an owner. GDPR Art. 33: notify the authority without undue delay and, where feasible, within 72 hours of becoming aware, unless a risk is unlikely | A draft notice, owner's contact |
What it costs to build yourself and when the idea will not pay back
Count four items: your build time, subscriptions and hosting, a specialist review and monthly support. The benefit is the manual hours removed. Payback is one-off cost divided by net monthly benefit; set the threshold first, 12 months here.
Illustrative rates: employee hour $20, owner $50, developer $80, subscription and hosting $25-120 a month; not tariffs. One-off: report, 10 owner hours; bot, 25 owner hours and 24 developer review hours; portal, 80 owner hours, 60 developer hours and $600 for counsel.
| Item | One-off cost | Net benefit per month |
|---|---|---|
| Report | $500 | $185 |
| Lead bot | $3,170 | $243 |
| Portal with payments | $9,400 | $120 |
Illustrative example: assumed rates, 12-month payback threshold
Scroll right to see all columns
| Idea | Saving, $/month | One-off cost, $ | Monthly cost, $ | Net benefit, $/month | Payback, months |
|---|---|---|---|---|---|
| Report from an order export (3 h/week) | 260 | 500 | 75 | 185 | 2.7 |
| Bot for leads with customer data (5 h/week) | 433 | 3,170 | 190 | 243 | 13.0 |
| Customer portal with payments (12 h/week) | 1,040 | 9,400 | 920 | 120 | 78 |
The first week: a weekend assignment
Start with a report-class task, not a bot that talks to customers. Result of the week: a working tool on a data copy, logged hours and a decision against the threshold.
- Pick a weekly manual task whose data holds no customer personal details.
- Write down what "done" means and prepare 10 examples with a known answer.
- Build on a copy of the data and keep versions so you can roll back.
- Compare with the manual result on those 10 examples and one real week; resolve differences.
- Log hours for building, fixing and support: a measurement, not a feeling.
- Run it in parallel with the manual work for two weeks.
- Calculate payback as above and decide: keep, hand to a developer or drop.
Key decisions
- build yourself what is cheap to get wrong and holds no one else's data or money; give the rest to a developer
- measure savings on your own task: studies on speed and safety are limited, and some data come from earlier tool versions
- before launching with customer data, run the check table: data, access, keys, payments, backups, breach plan
What to discuss with your team
- The task is classed (internal, customer data, money) and the builder follows the strictest row
- 10 examples with known answers match the tool's output
- Until reviewed, the tool runs on a data copy
- Access is tested from another account; keys sit outside code and browser
- A backup, a rollback and a person who fixes things exist
- Payback includes support and review; the threshold was set first
Terms in plain language
- Vibe coding
- Building software by describing the task to an AI without checking the code; the term was introduced by Andrej Karpathy in February 2025
- Vulnerability
- A flaw in a program or its settings that an outsider can exploit
- Row level security (RLS)
- Database rules on which records each user can see
- PCI DSS
- The global security standard for anyone who stores, processes or transmits bank card data
Sources
- Andrej Karpathy, post on X, February 2025: the introduction of the term "vibe coding"x.com · checked 03/11/2026
- Andrej Karpathy, post on X, 4 February 2026: a year later, "agentic engineering"x.com · checked 03/11/2026
- Simon Willison, weblog, 19 March 2025: not all AI-assisted programming is vibe codingsimonwillison.net · checked 03/11/2026
- METR, 10 July 2025: the impact of early-2025 AI on experienced open-source developers (randomized trial)metr.org · checked 03/11/2026
- METR, 24 February 2026: uplift update on late-2025 AI toolsmetr.org · checked 03/11/2026
- Stack Overflow Developer Survey 2025: AI section, the vibe coding questionsurvey.stackoverflow.co · checked 03/11/2026
- Stack Overflow Developer Survey 2025: methodology (dates, recruitment)survey.stackoverflow.co · checked 03/11/2026
- Veracode, 30 July 2025: press release on the GenAI code security researchveracode.com · checked 03/11/2026
- Veracode, 30 July 2025: blog post with results by languageveracode.com · checked 03/11/2026
- Perry, Srivastava, Kumar, Boneh: Do Users Write More Insecure Code with AI Assistants? (ACM CCS 2023)arxiv.org · checked 03/11/2026
- Matt Palmer: statement on CVE-2025-48757 and the scan resultsmattpalmer.io · checked 03/11/2026
- NVD (NIST): record CVE-2025-48757, tagged disputednvd.nist.gov · checked 03/11/2026
- Supabase documentation: Row Level Securitysupabase.com · checked 03/11/2026
- OWASP Top 10:2025, the list of vulnerability categoriestop10.owasp.org · checked 03/11/2026
- Claude Code: overview in Anthropic documentationcode.claude.com · checked 03/11/2026
- Lovable documentation: introductiondocs.lovable.dev · checked 03/11/2026
- Replit Agent documentationdocs.replit.com · checked 03/11/2026
- SourceCraft Code Assistant (formerly Yandex Code Assistant): service page (in Russian)sourcecraft.dev · checked 03/11/2026
- Anthropic: Supported Regions Policyanthropic.com · checked 03/11/2026
- Claude: pricing pageclaude.com · checked 03/11/2026
- Federal Law 152-FZ on Personal Data (Russia), Article 3: definitions (GARANT, in Russian)base.garant.ru · checked 03/11/2026
- Federal Law 152-FZ, Article 18: operator duties when collecting data, part 5 (GARANT, in Russian)base.garant.ru · checked 03/11/2026
- Federal Law 152-FZ, Article 19: security measures (GARANT, in Russian)base.garant.ru · checked 03/11/2026
- Federal Law 152-FZ, Article 21: incident notification, part 3.1 (GARANT, in Russian)base.garant.ru · checked 03/11/2026
- Roskomnadzor personal data portal: incident notification form (in Russian)pd.rkn.gov.ru · checked 03/11/2026
- Federal Law 152-FZ, Article 22: notification of processing, part 1 (GARANT, in Russian)base.garant.ru · checked 03/11/2026
- Rossiyskaya Gazeta: Law of 26.07.2026 N 265-FZ amending Article 12 of the Russian personal data law (in Russian)rg.ru · checked 03/11/2026
- GDPR Article 32: security of processing (regulation text as published by intersoft consulting)gdpr-info.eu · checked 03/11/2026
- GDPR Article 33: notification of a personal data breach to the supervisory authority (regulation text)gdpr-info.eu · checked 03/11/2026
- FTC (US): Protecting Personal Information, a Guide for Business, October 2016ftc.gov · checked 03/11/2026
- Stripe: integration security guide and PCI DSSdocs.stripe.com · checked 03/11/2026
- YooKassa: payment acceptance scenarios, collecting payment data and PCI DSS (in Russian)yookassa.ru · checked 03/11/2026