What is vibe coding?

Where the term comes from

The term “vibe coding” was coined by Andrej Karpathy in February 2025 to describe a new way of working: you fully give in to the vibes, embrace exponentials, and forget that the code even exists. Instead of writing every line yourself, you describe the product, accept whatever the model suggests, and iterate on the result.

What started as a personal experiment became the default workflow for a generation of solo founders and indie hackers. AI coding tools now generate entire applications from a single prompt — landing pages, SaaS dashboards, browser extensions, mobile apps — in hours instead of weeks.

Why vibe coding took off

• Speed. What took a weekend of boilerplate now takes a prompt. Ideas go from conversation to deployed URL in a day.
• Accessibility. People who never learned to program can build working software — product thinking matters more than syntax.
• Cheap iteration. When generating a new version costs seconds, you can test ten ideas instead of committing to one.
• Compound expertise. The AI writes code; you review it, learn from the diff, and get better at directing it.

The security gap nobody warns you about

Vibe coding changes how muchcode you produce, but it doesn't change how much of it is secure. AI models are trained on public code — including the mistakes in it. The classic failure modes show up constantly in AI-generated apps:

• API keys and secrets hard-coded into client-side bundles
• Missing or misconfigured security headers (CSP, HSTS, X-Frame-Options)
• Open admin panels and debug routes left in production
• Unsanitized inputs leading to XSS or injection
• Exposed configuration and backup files (.git, .env, logs)
• Outdated dependencies with known vulnerabilities

None of these are exotic. They are the top results of any automated scan of a freshly vibe-coded site — and attackers know exactly where to look, because they scan for them at scale.

How to vibe code safely

You don't have to give up the speed. You just have to add the safety net that traditional teams already had: automated checks.

• Scan before you ship. Run a website security scanner on every deploy. Vergate's passive scan finishes in seconds; an active scan digs deeper in minutes.
• Scan from your editor. Vergate ships an MCP server so Claude Code, Cursor, Windsurf and VS Code can scan and report findings inline.
• Keep secrets out of the repo.Use environment variables, and let a scan tell you when you've leaked one.
• Monitor after launch.Security isn't a one-time event — new vulnerabilities are published daily. Continuous scanning catches regressions the moment they appear.
• Review the diff.You don't need to read every line, but skim what the AI changed and test the happy path and the error paths.