More and more businesses are building their website, store, or first app by “chatting” with an AI: you describe what you want, the AI writes the code, you test it, it works, you publish it. No hiring, no weeks of waiting, no development budget. This process has a name now: vibe coding. And it works —for what you can see. The problem lives in what you can’t.
What vibe coding actually is
The term was coined in early 2025 by OpenAI researcher Andrej Karpathy, to describe programming by going along with whatever the AI suggests, accepting its output without reading or understanding the code line by line. It’s not the same as “using AI to code” in general —an experienced developer also uses AI, but reviews, understands and corrects what it generates. Vibe coding specifically means skipping that part: trusting that if it works on screen, it’s fine.
For a small business without a technical team, this is a door that didn’t exist before: today you can have a working website, a quote calculator or a small management panel without writing a single line of code and without paying for custom development. That’s genuinely valuable. The problem shows up when that same ease makes it feel like no technical review is needed at all, because “it already works.”
Why “it works” and “it’s secure” aren’t the same thing
When you test your newly built site —filling out a form, browsing the pages, buying a test product— you’re checking that it does what it’s supposed to do. You’re not checking what else someone with worse intentions could make it do: whether that form accepts code instead of text, whether the admin panel is reachable with no password from a URL nobody told you existed, whether the database connection keys were left visible in the page’s own code. None of that shows up while using the site normally. It shows up when someone looks for it on purpose.
The real blind spot: you don’t know what you don’t know
Here’s the difference with a design or content flaw, which anyone can spot just by looking at the site. A security flaw in the code isn’t caught by someone who doesn’t know what to look for —not even the AI that wrote it warns you it’s left something exposed, because it was never asked to think about security, it was asked to make the feature work. We covered a real example of exactly this in an earlier article: a project built over a single weekend using only AI that leaked 1.5 million credentials within 72 hours, over a flaw that any basic review would have caught.
This isn’t about avoiding AI when building your website —we build websites with artificial intelligence ourselves to move faster. It’s about not confusing speed with the end of the process: AI speeds up the building part, but the reviewing part is still human work, and skipping it can turn that early time saved into a very expensive problem later.
If your website was built this way and has never gone through a real security review, now’s a good time to ask for one: tell us how your site was built and we’ll tell you what’s worth checking.
Frequently asked questions
Is vibe coding the same as using ChatGPT or Claude to code?
Not exactly. Using an AI as a coding aid is just another tool, like a spell checker for writing. Vibe coding specifically means accepting what the AI generates without reviewing or understanding it, letting it be the project’s only quality control layer.
How do I know if my website was built with vibe coding?
If you, or whoever built it, described what you wanted to an AI and published the result without anyone technically qualified reviewing the generated code —database connections, permissions, forms—, it probably falls into this category, regardless of how good the end result looks.
How much does it cost to review a website already built with AI?
It depends on size and complexity, but it’s usually a fraction of what rebuilding from scratch would cost, and far less than what recovering from a data leak costs. It’s a one-time review that can be done on what already exists, without having to redo anything that already works well.