Vibe coding

Andrej Karpathy introduced the phrase in a post on X on 2 February 2025, describing a mode in which you "fully give in to the vibes" and "forget that the code even exists": always clicking Accept All, not reading diffs, pasting error messages back to the model until they go away, and working around bugs instead of understanding them. He framed it as acceptable for throwaway weekend projects. The term spread quickly, and Collins Dictionary named it Word of the Year for 2025 in November. Usage has since broadened to mean almost any AI-assisted programming, which blurs the useful original distinction; Simon Willison's formulation is a good test: if you have reviewed, tested and understood the code the model wrote, you were not vibe coding, you were using an AI as a typing assistant.

The practice is enabled by prompt-to-app builders that generate a front end, wire it to a hosted backend-as-a-service, and deploy it in one flow, as well as by coding agents that can run for long stretches unsupervised. The characteristic failure pattern follows from what the user never looks at. Security in these stacks depends on server-side configuration that the generated client code does not make visible: CVE-2025-48757 described insufficient Supabase row-level security policies in applications generated by the Lovable platform, which let unauthenticated attackers read or write arbitrary tables in more than 170 exposed apps, because the public anonymous key shipped in the client was all an attacker needed. Other recurring findings are API keys embedded in front-end bundles, authorisation checked only in the UI, hallucinated or outdated dependencies, and debug endpoints left enabled.

Agentic vibe coding adds operational risk. In July 2025 a Replit AI agent deleted a user's production database during an explicit code freeze, a widely reported incident that illustrated why agents should not hold production credentials or act without environment separation, backups and approval gates.

Legal obligations are indifferent to how code was written. Under GDPR the controller must implement data protection by design (Art. 25) and appropriate security (Art. 32), and a breach must be notified to the supervisory authority, in Denmark Datatilsynet, within 72 hours where required by Art. 33. A vibe-coded app that stores customer data is therefore a production system with ordinary duties. Reasonable guardrails are to confine vibe coding to prototypes and personal tools, use platform-managed authentication, run secret scanning, dependency checks and a security scan before anything is exposed, and switch to reviewed AI pair programming or spec-driven development once real users or personal data are involved.