The term comes from a February 2025 post by Andrej Karpathy, who described a new kind of coding where you give in to the vibes and forget that the code even exists, because the models have become good enough to make that possible. Tools such as Lovable, Bolt, v0, Cursor and Replit have made this the normal way many founders now ship a first product.
The benefit is speed. The risk is that nobody has reviewed the parts you cannot see on screen. The app looks finished because the pages render and the buttons work, but security lives in places a demo never exercises: whether the database refuses a request from the wrong user, whether a secret key ended up in the browser bundle, whether an API route checks who is calling it.
Vibe coding does not make an app insecure by itself. What makes it risky is shipping without any check on the things the model was never asked about. Treat generated code as a draft from a fast junior developer: ask the model to explain its access rules, test your app as a logged-out and a second user, and review anything that touches keys, payments, authentication or personal data before real users arrive.