What Even Is Vibe Coding?

Three weeks ago I sat down with Cursor, a blank project folder, and a dangerous amount of coffee. My goal: build a complete business website from zero — no pre-written code, no templates, just prompts. Pure vibes.

It worked. Mostly.

That "mostly" is the whole story.

Andrej Karpathy coined the term in early 2025. The idea is stupidly simple: you describe what you want to build in plain English, the AI writes the code, you iterate on prompts until the thing looks and works how you want. No syntax memorization. No Stack Overflow rabbit holes.

Sounds like cheating. 92% of US developers now do it daily anyway.

The tools that make this actually usable right now are Cursor, Bolt, v0, Lovable, and Replit. Each has a slightly different vibe (sorry, had to). Cursor is great if you already know some code and want to stay in a real editor. Bolt and Lovable are wild for people who've never written a line of JavaScript in their life and want a full web app by Tuesday.

The 45-Minute Website

Here's what I built: a simple service business site. Homepage with hero section, a services page, a contact form that actually sends emails, and a basic blog. Four pages. Real functionality.

My first prompt was something like: "Create a Next.js website for a local landscaping business called Green Peak. Include a homepage with hero, services page, contact form with email via Resend, and a blog page."

The AI spit out roughly 800 lines of code. I ran it. It worked. Not "kind of worked." It worked — clean layout, form submissions routed, blog rendering. I genuinely sat there for a minute blinking at my screen. That used to take three days.

Then I dug into the code.

The Part Nobody Talks About

Okay. Deep breath.

41% of all code written globally is now AI-generated. That number is wild. But here's the stat that should give you pause: roughly 24.7% of AI-generated code contains at least one security flaw. And AI co-authored code shows 2.74x more security vulnerabilities than human-written code.

Let me show you what that looked like in practice.

My contact form was sending emails fine. But the implementation had no rate limiting. None. Someone could hit that endpoint 10,000 times in a minute and rack up a serious Resend bill, or just take the site down with garbage requests. The AI built a working feature that was also a quiet footgun waiting to go off.

I also found an exposed API key — commented out, but sitting right there in a component file that would have been committed to GitHub. Easy to miss if you're in "just vibing" mode and not actually reading the code.

Neither of these are catastrophic errors. Both would have caused real problems in production. Actually, let me back up. The bigger issue isn't even the security stuff. The bigger issue is what AI-generated code looks like under the hood.

The Maintenance Problem

AI code tends to be... fine. Functional. But it often lacks the kind of thoughtful structure that makes a codebase easy to change six months later. Variable names like data2 and tempHandler. Logic duplicated across three files instead of extracted into a shared function. Components that do 14 things when they should do two.

I tested this specifically. Asked the AI to add a feature to the blog page — a category filter. Took four prompts and the AI kept breaking the existing search functionality because the code structure wasn't organized in a way the AI could cleanly extend.

With a well-structured human-written codebase, that's maybe a 30-minute task. With the vibe-coded version, it took two hours and one moment where I genuinely considered deleting everything and starting fresh.

Performance is the other thing. The first version of my site had a Largest Contentful Paint of 4.2 seconds. Not because the AI wrote bad HTML — it didn't — but because it defaulted to loading patterns that weren't optimized. No lazy loading on images. No proper font loading strategy. Imported a full icon library when I needed three icons.

These are fixable. But you have to know to look.

Who Should Actually Use This

Here's my take, and I'll be direct about it.

If you're a business owner who has never coded and you want to explore what's possible — vibe coding tools like Lovable or Bolt are genuinely magic. You can prototype ideas, test product concepts, and build internal tools faster than you have any right to. Go play.

If you're shipping something to real customers with real data and real transactions? Get a professional involved, at minimum, to audit what the AI built.

If you're a developer who's been doing this for years — the tools will make you obnoxiously fast. I mean that as a compliment. The boring boilerplate that used to eat your afternoons is just... gone. You can spend your time on the interesting problems. But stay in the loop. Don't just accept what the AI gives you without reading it.

The mistake I see people making is treating AI-generated code like downloaded software — assuming it just works because it shipped. It doesn't work that way. The AI has no idea what your production environment looks like. It doesn't know your traffic patterns or compliance requirements or that your client really hates it when the contact form breaks.

You're still the architect. The AI is a very fast, very well-read junior developer who has read every Stack Overflow post ever written and is also occasionally wrong with complete confidence.

The Market Is Betting Big On This

Let's put some numbers on where this is going.

The vibe coding market sits at $4.7 billion right now. Projected to hit $12.3 billion by 2027. That's 38% compound annual growth — which means every major development tool is sprinting to get AI-first, fast.

GitHub Copilot, Cursor, Windsurf, Claude Code, Devin — the field has exploded. And the actual impact on developer productivity is measurable. Teams using AI coding tools are shipping features in roughly half the time. Not 10% faster. Half.

For web development specifically, this matters a lot because the bar for "can I build this?" keeps dropping. Which means more people are building things. Which means more sites in production with the problems I described above.

I'm not saying this to scare you off vibe coding. I'm saying it because the people who are going to get burned are the ones who mistake speed for quality. Fast and broken is worse than slow and solid.

What I Actually Do Now

After that 45-minute experiment, I built a process that works for me.

Prompt first, read second. Always. I never run code without skimming it. Takes five minutes and has caught three separate issues since I started.

Security pass before deployment. Rate limiting, input validation, no secrets in code. These are five-minute checks but they stop real problems.

Performance audit every time. One Lighthouse run and a quick look at what's being loaded. Catches the obvious stuff.

Ask the AI to explain its own choices. This is actually wild and useful — "why did you structure it this way?" often reveals where it made assumptions that don't match your requirements.

The 45-minute website I built that day? I shipped a cleaned-up version to a real client two weeks later. The AI did probably 70% of the work. I did 30%, but that 30% was the part that made it production-ready and actually maintainable.

That's the split that feels right to me. Not "AI does everything" and not "AI is just a fancy autocomplete." Something in the middle, where the human is still steering.

The Bottom Line

Vibe coding is real. It's fast. It can absolutely help you build better websites faster.

But it's not magic. It's a junior developer with infinite patience and a tendency to miss the obvious.

If you're a business owner thinking about using AI tools to build or update your site — brilliant. Test things, see what's possible, stay curious. Just don't deploy it without having someone look at what it actually built.

If you're a developer who hasn't tried vibe coding yet — you're leaving productivity on the table. Not even close. Start with Cursor on a low-stakes project this week. You'll be annoyed at how fast it goes.

The builders who thrive in 2026 aren't the ones who refuse AI, and they aren't the ones who turn off their brain and let AI run. They're the ones who figured out how to be better because of it.

I Vibe-Coded a Website in 45 Minutes. Here's What Nearly Broke It.