Vibe coding is the practice of building software by describing what you want in plain English and letting an AI model write the code, set up the database, and deploy the app for you. You don't read the code. You don't pick the framework. You describe a feature, the AI ships it, and you keep going until the app does what you imagined.
The term was coined by Andrej Karpathy in February 2025. By 2026 it's the default onboarding path for non-technical founders, the most common reason people show up at our door, and the reason a category of work exists that didn't 18 months ago.
This is the guide I wish I could send to every founder I talk to in their first week.
01Where the term came from
Karpathy's original framing was almost throwaway: he described being able to “fully give in to the vibes”: speaking changes into a chat window, accepting them without reading, only intervening when something visibly broke. The point wasn't that this was always the right way to build software. The point was that for a certain class of small projects, it was suddenly possible, and it felt different.
What changed wasn't the AI's coding ability, which had been improving steadily. What changed was the orchestration. The model could now hold the whole project in its head, run the code, see the errors, fix them, and present a working app at the end. The human became a director, not an editor.
That's vibe coding.
02The five tools that matter in 2026
Five products dominate vibe coding in 2026. They overlap, but each has a sweet spot.
Lovable. Full-stack web apps from a chat interface. Best in class for UI speed: a working prototype in 30 minutes, deployed to Lovable's own hosting, connected to Supabase by default for the database. Where most non-technical founders start.
Bolt (StackBlitz). Fastest path from idea to a public URL. Excellent for prototypes you want to share with five people on Monday. Database management is more painful than Lovable, but the deployment story is smoother.
Cursor. An IDE, not a chat window. The code lives on your machine and you can edit it. The learning curve is real (you need to understand a little about files and the terminal), but you own everything you build. The right tool the moment your prototype starts mattering.
Replit Agent. Cloud IDE with an agentic builder layered on top. The “talk to it, it builds it, it runs it, all in your browser” experience. Strong for hobbyists and educational projects.
Claude. Used two ways. Through claude.ai for direct code generation in conversation: you describe, it writes, you copy into your project. And through Claude Code, a terminal-based agent that works directly on your codebase, makes commits, and runs commands. Heavier than the others, but the one most often paired with the rest when things get real.
03Who's actually vibe coding
The audience has expanded faster than anyone predicted.
Non-technical founders are the largest group. Someone with a clear product idea, no coding background, and a need to validate the idea cheaply before paying anyone. Idea to working prototype in a weekend.
Hobbyists and side-projecters ship more than they used to. The tools removed the activation energy: the fiddling with environments, the choice paralysis over frameworks. People who'd given up on side projects are shipping again.
Designers and PMs vibe-code the prototype that used to require pulling in an engineer. The Figma-to-working-app loop is now a single chat session.
The accidental developer: the marketer or operations lead whose CEO built something on the weekend and now expects them to “just maintain it.” This persona didn't exist two years ago. It's now the second most common reason someone shows up needing an audit.
04What vibe coding is genuinely good at
Speed to first demo. A working app users can click through, in hours. Pre-vibe-coding, this took two to four weeks of contractor time and four-figure budgets.
Iteration during validation. Changing the data model, the UI, the flow, all without the rebuild cost that used to make pivots painful. Founders who vibe-code often run more product experiments in their first month than dev-shop-built startups do in their first year.
Internal tools. A vibe-coded dashboard for your team to track something is often perfect for the job. Low stakes, low traffic, no security concerns beyond the company VPN.
Founder learning. Founders who vibe-code often understand their own product better than founders who outsource to a dev shop. They've shaped every screen.
05Where it consistently falls apart
This is the part that doesn't get talked about enough.
The tools are optimized to make something work. They are not optimized to make it last. The five issues that show up in nearly every vibe-coded app I see: no proper authentication (logins checked in the browser instead of the server), no database-level security so every user can read every other user's data (the RLS problem), hardcoded API keys sitting in publicly visible JavaScript, no separation between development and production environments, and error messages that leak database internals to users.
None of these are the tools' fault. Lovable and Bolt are doing exactly what you asked: build the feature. Auth is invisible work. Database security policies don't show up in screenshots. The AI optimizes for what you can see.
06The state of play in May 2026
Three things are true at once.
The tools are better than they were even six months ago. Lovable now ships with reasonable defaults for auth in most cases. Cursor's agent mode catches obvious security issues. Claude Code can run a security review pass on a repo when asked.
But the floor has not risen as fast as the ceiling. The same five issues still appear in apps shipped this month. The defaults are better, but defaults aren't the same as fixed.
And the founder population is now large enough that the “I have real users on a vibe-coded app” cohort is in the tens of thousands. Most of them don't know what they don't know. The ones who do know often don't have the time to fix it.
That's the work. Vibe coding gets you 80% of the way there in an afternoon. The last 20% is the difference between a demo and a product. We help with that 20%.
→If you've shipped a vibe-coded app
And you're not sure what shape that 20% takes for you: run the free three-minute audit. It tells you exactly which of the five issues above your app has, and how serious each one is. No account, no sales call, no spam.
Or if you want to start with the most common one, read the next piece in this guide, the one on row level security, the database setting your AI almost certainly didn't turn on.