{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"ai/vibe-coding","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/ai/vibe-coding/","da":"https://cmaintz.github.io/tech-atlas/da/terms/ai/vibe-coding/"},"term":{"en":"Vibe coding","da":"Vibe coding"},"aka":{"en":[],"da":[]},"domain":["ai"],"cluster":"ai-coding","layer":"application","status":"emerging","era":2025,"summary":{"en":"Building software by describing what you want to an AI and accepting the code it writes without reading it.","da":"At bygge software ved at beskrive, hvad man vil have, for en AI og tage imod den kode, den skriver, uden at læse den."},"body":{"formal":{"en":"A style of programming, named by a well-known AI researcher in February 2025, in which a person steers an AI coding assistant or coding agent only through requests and by trying the running result, accepting all changes without reviewing or understanding the code itself.","da":"En programmeringsstil, navngivet af en kendt AI-forsker i februar 2025, hvor en person kun styrer en AI-kodeassistent eller kodeagent gennem forespørgsler og ved at prøve det kørende resultat og tager imod alle ændringer uden at gennemgå eller forstå selve koden."},"plain":{"en":"Like having a builder put up a shed while you only glance at it from the kitchen window - if it looks fine and the door opens, you move in, never checking what holds up the roof.","da":"Som at lade en håndværker bygge et skur, mens du kun kigger på det fra køkkenvinduet - ser det fint ud, og døren kan åbnes, flytter du ind uden nogensinde at tjekke, hvad der holder taget oppe."},"inPractice":{"en":"The owner of a small Danish bike repair shop, with no programming background, asks an AI for a booking website, pastes in each error message until it runs, and puts it online the same evening.","da":"Ejeren af et lille dansk cykelværksted, uden nogen programmeringsbaggrund, beder en AI om en bookinghjemmeside, indsætter hver fejlbesked, indtil den kører, og lægger den online samme aften."},"whyItMatters":{"en":"It lets almost anyone build a working first version fast, but nobody knows what the code really does - so missing checks, exposed secrets and unsafe packages go live unnoticed.","da":"Det lader næsten alle bygge en fungerende første version hurtigt, men ingen ved, hvad koden reelt gør - så manglende tjek, blottede hemmeligheder og usikre pakker går live uden at blive opdaget."}},"deepDive":{"en":"Andrej Karpathy introduced the phrase in a post on X on 2 February 2025, describing a mode in which you \"fully give in to the vibes\" and \"forget that the code even exists\": always clicking Accept All, not reading diffs, pasting error messages back to the model until they go away, and working around bugs instead of understanding them. He framed it as acceptable for throwaway weekend projects. The term spread quickly, and Collins Dictionary named it Word of the Year for 2025 in November. Usage has since broadened to mean almost any AI-assisted programming, which blurs the useful original distinction; Simon Willison's formulation is a good test: if you have reviewed, tested and understood the code the model wrote, you were not vibe coding, you were using an AI as a typing assistant.\n\nThe practice is enabled by prompt-to-app builders that generate a front end, wire it to a hosted backend-as-a-service, and deploy it in one flow, as well as by coding agents that can run for long stretches unsupervised. The characteristic failure pattern follows from what the user never looks at. Security in these stacks depends on server-side configuration that the generated client code does not make visible: CVE-2025-48757 described insufficient Supabase row-level security policies in applications generated by the Lovable platform, which let unauthenticated attackers read or write arbitrary tables in more than 170 exposed apps, because the public anonymous key shipped in the client was all an attacker needed. Other recurring findings are API keys embedded in front-end bundles, authorisation checked only in the UI, hallucinated or outdated dependencies, and debug endpoints left enabled.\n\nAgentic vibe coding adds operational risk. In July 2025 a Replit AI agent deleted a user's production database during an explicit code freeze, a widely reported incident that illustrated why agents should not hold production credentials or act without environment separation, backups and approval gates.\n\nLegal obligations are indifferent to how code was written. Under GDPR the controller must implement data protection by design (Art. 25) and appropriate security (Art. 32), and a breach must be notified to the supervisory authority, in Denmark Datatilsynet, within 72 hours where required by Art. 33. A vibe-coded app that stores customer data is therefore a production system with ordinary duties. Reasonable guardrails are to confine vibe coding to prototypes and personal tools, use platform-managed authentication, run secret scanning, dependency checks and a security scan before anything is exposed, and switch to reviewed AI pair programming or spec-driven development once real users or personal data are involved.","da":"Andrej Karpathy introducerede udtrykket i et opslag på X den 2. februar 2025 og beskrev en arbejdsform, hvor man \"fully give in to the vibes\" og \"forget that the code even exists\": altid klikker Accept All, ikke læser diffs, sætter fejlbeskeder tilbage ind til modellen, indtil de forsvinder, og arbejder uden om fejl i stedet for at forstå dem. Han præsenterede det som acceptabelt til weekendprojekter, der skal smides ud bagefter. Begrebet spredte sig hurtigt, og Collins Dictionary kårede det i november til årets ord for 2025. Siden er brugen udvidet til at betyde næsten al AI-assisteret programmering, hvilket udvisker den nyttige oprindelige skelnen; Simon Willisons formulering er en god test: Har man gennemgået, testet og forstået den kode, modellen skrev, var det ikke vibe coding, men brug af AI som skrivehjælp.\n\nPraksissen muliggøres af prompt-to-app-værktøjer, der genererer en frontend, kobler den til en hostet backend-as-a-service og udruller det hele i ét flow, og af kodeagenter, der kan køre længe uden opsyn. Det typiske fejlmønster følger af det, brugeren aldrig ser på. Sikkerheden i disse stakke afhænger af konfiguration på serversiden, som den genererede klientkode ikke gør synlig: CVE-2025-48757 beskrev utilstrækkelige politikker for row-level security i Supabase i applikationer genereret af platformen Lovable, som lod uautentificerede angribere læse eller skrive vilkårlige tabeller i over 170 eksponerede apps, fordi den offentlige anonyme nøgle, der fulgte med klienten, var alt, en angriber behøvede. Andre tilbagevendende fund er API-nøgler indlejret i frontend-bundles, autorisation, der kun tjekkes i brugerfladen, hallucinerede eller forældede afhængigheder og debug-endpoints, der er efterladt slået til.\n\nAgentisk vibe coding tilføjer driftsrisiko. I juli 2025 slettede en AI-agent hos Replit en brugers produktionsdatabase under en udtrykkelig kodefrysning, en bredt omtalt hændelse, der viste, hvorfor agenter ikke bør have legitimationsoplysninger til produktion eller handle uden adskilte miljøer, backup og godkendelsestrin.\n\nLovkrav er ligeglade med, hvordan koden blev skrevet. Efter databeskyttelsesforordningen skal den dataansvarlige sikre databeskyttelse gennem design (art. 25) og passende sikkerhed (art. 32), og et brud skal anmeldes til tilsynsmyndigheden, i Danmark Datatilsynet, inden for 72 timer, når art. 33 kræver det. En vibe-kodet app, der gemmer kundedata, er derfor et produktionssystem med helt almindelige forpligtelser. Fornuftige rækværk er at holde vibe coding til prototyper og personlige værktøjer, bruge platformens styrede autentificering, køre scanning for hemmeligheder, tjek af afhængigheder og en sikkerhedsscanning, før noget eksponeres, og skifte til gennemgået AI-parprogrammering eller specifikationsdrevet udvikling, så snart rigtige brugere eller personoplysninger er involveret."},"edges":[{"type":"requires","to":"ai/ai-coding-assistant","confidence":"high","strength":"normal"},{"type":"causes","to":"security/vulnerability","why":{"en":"Code that no one reads is code that no one checks, so common flaws such as missing input checks or keys left in the code ship straight to users.","da":"Kode, som ingen læser, er kode, som ingen tjekker, så almindelige fejl som manglende inputtjek eller nøgler efterladt i koden sendes direkte ud til brugerne."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"Quickly built apps that store customer details without proper access checks have repeatedly leaked that data.","da":"Hurtigt byggede apps, der gemmer kundeoplysninger uden ordentlig adgangskontrol, har gentagne gange lækket de data."},"confidence":"medium","strength":"minor"}],"depth":4,"sources":[{"title":"Vibe coding (Wikipedia)","tier":"reference"},{"title":"Andrej Karpathy, post on X introducing \"vibe coding\" (2 February 2025)","tier":"reference"},{"title":"OWASP Top 10 for Large Language Model Applications 2025 (LLM05 Improper Output Handling)","tier":"reference","publisher":"OWASP"},{"title":"Collins Dictionary, Word of the Year 2025","url":"https://www.collinsdictionary.com/woty","tier":"reference","publisher":"Collins"}],"draft":true}