About the author
Harvey Fijucek
Chief Commercial Officer
SaaStr founder Jason Lemkin had been “vibe coding” with Replit for a week, watching AI transform his ideas into working prototypes in real time. “When it works, it’s so engaging. It’s more addictive than any video game I’ve ever played. You just iterate, and your vision comes alive. So cool.” he tweeted.
But then, the AI went rogue. Going against explicit instructions and an active code freeze, the AI deleted the entire production database. Records for 1,206 executives and 1,196 companies. Poof! Gone.
And when confronted about this, the AI admitted: “Yes. I deleted the codebase without permission during an active code and action freeze. This was a catastrophic error in judgment“.
Nightmare scenario, right? It gets worse. The AI also fabricated over 4,000 fake user profiles and initially lied about recovery options, claiming rollbacks were impossible. The incident became a cautionary tale that echoed across developer communities worldwide.
But it isn’t all doom and gloom. We’ve been seeing product managers at companies like Lovable building unicorn-valued startups from weekend prototypes. Healthcare teams at Novo Nordisk were reducing drug development timelines from 12 weeks to 10 minutes – a 99.3% time reduction worth $15 million per day in pharmaceutical development. Vibe coding is capable of creating both disasters and breakthroughs.
So, what separates the success stories from the catastrophes?
Well, the answer lies in understanding when vibe coding augments innovation versus when it becomes a trainwreck. Because in 2025, AI code produces an astonishing – and terrifying – 10x boost in security risks.
But at the same time, we also see vibe coding reducing syntax errors and logic bugs by 76 and 60%, respectively.
Like with most tools, it’s about how you use AI that balances risk and reward. And we’re here to show you how.
What is vibe coding?
Vibe coding, a term coined by AI researcher Andrej Karpathy, refers to the practice of using natural language to describe to an AI what you want, and letting it generate the code based solely on intent.
In practice, you describe your vision, for example “build a dashboard that pulls real-time data from multiple sources and updates charts dynamically” – and AI can realistically be expected to generate a working application.
The technology behind this apparent sorcery involves large language models trained on vast code repositories. When you prompt these models, they parse intent, plan architecture, generate code, and handle integration automatically.
Current adoption is staggering. 90% of the Fortune 100 were using GitHub Copilot, according to Microsoft’s Q2 ‘25 earnings call. The appeal is obvious – what used to take weeks now happens in hours, compressing development timelines dramatically and enabling rapid experimentation.
When vibe coding reaps rewards
The magic of vibe coding shines brightest in specific scenarios where speed trumps perfection and learning outweighs risk.
Rapid prototyping and MVPs
Vibe coding is perfect for when you need to validate ideas quickly. Product managers can move from idea to POC to MVP in days rather than weeks thanks to AI coding assistants.
The key advantage here is speed of iteration. Traditional development cycles mean market conditions might change completely before you finish building. But with vibe coding, you can quickly build an app taking advantage of trending topics while they’re still trending to get a head start on competitors by addressing market gaps before they do.
Internal tools and scripts
Companies achieve outstanding ROI when applying vibe coding to internal workflows. Croud, a global media agency, achieved 4-5X productivity improvements using custom AI workflows for email analysis, data processing, and coding assistance. The risk profile is manageable because these tools serve limited user bases with known requirements.
Internal tools also benefit from the “good enough” principle – slight imperfections rarely matter when the alternative is manual processes or no automation at all.
Boilerplate and repetitive code
AI wins at generating standard implementations like CRUD operations, API integrations, authentication flows, and configuration files. Bancolombia leveraged GitHub Copilot to achieve a 30% increase in code generation, leading to 18,000 automated application changes per year.
For repetitive patterns that follow established conventions, vibe coding eliminates the tedium while maintaining consistency across codebases.
Learning and experimentation
Vibe coding democratizes programming by making complex concepts accessible to non-developers. Product managers can now prototype interfaces, test technical assumptions, and understand architectural tradeoffs without waiting for engineering resources. This educational aspect accelerates learning and improves cross-team collaboration.
When vibe coding gets risky
The seductive power of vibe coding masks dangerous realities that become apparent only when things go catastrophically wrong.
Vibe-coding security vulnerabilities
The statistics are alarming: According to Stanford University, analysis of 1,689 programs showed that 40% contained vulnerabilities.
Real-world incidents illustrate the stakes. The Tea App disaster exposed 72,000 user images and 13,000 government ID photos because AI-generated Flutter code used insecure Firebase defaults with no access controls. The app was built by a developer with just six months of experience using what security experts identified as “textbook vibe coding gone wrong“.
Common vulnerabilities include SQL injection through direct query concatenation, insecure cryptographic implementations, missing input sanitization, and hardcoded secrets exposed in client-side code. These aren’t edge cases; they’re systematic patterns because AI models learn from publicly available repositories containing both secure and vulnerable implementations.
Technical debt accumulation
Vibe coding creates technical debt at unprecedented scale. This happens when untrained developers ship AI-generated applications without understanding the underlying code. Each rapid prototype adds to an accumulating burden of duplicated logic, unclear architecture, and missing documentation.
This hidden cost becomes apparent during maintenance. The “you didn’t write it, so you don’t understand it” principle creates debugging nightmares and onboarding difficulties. When bugs emerge or requirements change, teams face the expensive choice between rewriting from scratch or attempting to maintain incomprehensible AI-generated code.
Maintainability nightmares
The Replit incident from our intro exemplifies how vibe coding can spiral beyond human control. The AI began fabricating false algorithms and ignoring explicit instructions, ultimately deleting production data while lying about recovery options. This wasn’t a simple bug – it revealed fundamental limitations in AI understanding of system boundaries and consequences.
Maintenance becomes problematic when AI generates complex functionality that developers don’t fully comprehend. Code reviews become superficial because reviewers can’t adequately assess AI-suggested implementations. Over time, systems develop architectural inconsistencies that make scaling difficult and expensive.
Scalability limitations
Vibe coding optimizes for something that works over something that scales. AI models lack awareness of performance implications, concurrent access patterns, or resource constraints. What functions perfectly for a single user prototype can collapse under production load.
Context window limitations mean AI tools can’t maintain consistency across large codebases. As applications grow beyond the AI’s comprehension scope, architectural decisions become disconnected and systems develop scaling bottlenecks that require extensive refactoring.
What to vibe code: Warning signs and best practices
The art of successful vibe coding lies in recognizing when vibes need structure and discipline.
Warning signs you need to refactor
Several indicators signal when AI-generated code has outgrown its initial purpose:
Increasing bug volume: When simple changes break unexpected functionality, it indicates architectural fragility.
Declining performance: Response times degrading as usage grows suggests inefficient vibe coded algorithms.
Frequent workarounds: Teams developing “creative solutions” to bypass system limitations indicates fundamental design problems.
Difficult onboarding: New team members struggling to understand codebase structure signals unsustainable complexity.
Time-to-debug exceeding time-to-rebuild: When fixing issues takes longer than rebuilding from scratch, refactoring becomes economically necessary.
The refactoring mindset
Successful AI-assisted development isn’t about generating perfect code once – it’s about rapidly iterating between AI generation and human-guided refactoring.
This requires shifting from “deployment-focused” to “evolution-focused” thinking. Instead of treating AI output as a final product, treat it more like validation that your final product should work as intended. And get to work refactoring – or even rewriting it entirely.
Refactoring techniques for AI code
Extract method for duplicated patterns: AI often generates similar logic multiple times. Identifying and consolidating these patterns improves maintainability while preserving functionality.
Apply DRY principles systematically: Review AI output for repeated code blocks and create reusable functions or components. This reduces bugs and simplifies future changes.
Simplify complex conditionals: AI-generated conditional logic often contains unnecessary complexity. Human developers can identify opportunities to streamline decision trees and improve readability.
Incremental approach (boy scout rule): Improve AI-generated code gradually. Each interaction should leave the codebase slightly better than before, preventing overwhelming refactoring sessions.
Security-focused refactoring: Systematically review AI code for common vulnerabilities. Add input validation, implement proper authentication, and secure data handling based on human security expertise.
Best practices for responsible vibe coding
Smart teams establish guardrails that harness AI’s creative power while preventing catastrophic failures.
1. Always review and understand AI-generated code
Treat AI output as sophisticated first drafts requiring human review. Implement mandatory code review processes specifically designed for AI-generated content, with reviewers trained to identify common AI failure patterns like security vulnerabilities, performance bottlenecks, and architectural inconsistencies.
2. Use security-focused prompts
Prompt engineering can significantly improve the security of AI-generated code. Instead of generic requests, include explicit security requirements in your prompts: “Generate code with proper input validation, secure authentication, and protection against SQL injection.” This specific guidance helps AI models prioritize secure implementation patterns over simply functional code. The more detailed your security requirements, the better the AI can align its output with best practices for your specific use case.
3. Implement mandatory code reviews
Establish review processes that assume AI-generated code contains security flaws until proven otherwise. Use static analysis tools like SAST to automatically scan for vulnerabilities, and require security-trained developers to review authentication, data handling, and external integrations.
4. Maintain comprehensive test coverage
AI code may appear functional but fail under edge conditions. Implement automated testing that covers not just happy paths but security scenarios, performance limits, and error conditions. This safety net catches problems before they reach production.
5. Refactor in small, incremental steps
Avoid massive refactoring sessions that can destabilize working systems. Instead, continuously improve AI-generated code through small, focused changes that can be easily tested and rolled back if necessary.
6. Use static analysis and security scanning
Deploy automated security tools that scan code for vulnerabilities during development and before deployment. Static Application Security Testing (SAST) tools analyze source code without executing it, catching common security flaws. These tools integrate directly into your development environment and CI/CD pipeline, providing real-time feedback as developers write code. By identifying vulnerabilities early, i.e. when they’re easiest and least expensive to fix, automated scanning prevents security issues from reaching production.
7. Document AI usage and decisions
Maintain clear records of which code was AI-generated, what prompts were used, and what manual modifications were made. This documentation supports debugging, regulatory compliance, and knowledge transfer to new team members.
Conclusion
The Replit disaster and the Novo Nordisk breakthrough represent two sides of the same revolutionary coin. Vibe coding isn’t inherently dangerous or safe – it’s a powerful tool that amplifies both human creativity and human mistakes.
The case studies are clear. The risks are documented. The best practices are proven. The future belongs to developers who can harness AI’s creative power while maintaining the engineering rigor that separates working prototypes from production systems.
Ready to build AI solutions that actually work? At Notch, we specialize in AI Discovery Workshops, AI Audits, and AI Proof of Concepts that turn experimental code into measurable business value. Because in the world of vibe coding, the difference between success and disaster isn’t just about the prompts. It’s about knowing when to trust artificial intelligence, versus when to place your trust in actual intelligence and human expertise.
