Is Vibe Coding Bad? The Real Risks and How to Avoid Them

Vibe coding isn't bad in itself, but launching AI-written code that nobody has reviewed becomes risky as soon as customers, money or personal data are involved. For a landing page, a prototype or an internal tool, the risks are small and easy to manage. For anything with logins, payments or stored customer data, you need the safeguards below and usually a human review.

How risky is it? It depends on what you build

Most first projects sit in the top two rows, which is exactly where vibe coding works well. The five risks below matter more the further down the table you go.

Risk 1: security holes you can't see

Working code and safe code are different things, and the research on AI-written code says so plainly.

Veracode also found that larger, newer models were no more secure than smaller ones. The Lovable finding came from researchers who scanned projects in March 2025 and published the issue that May as CVE-2025-48757, a public ID for a known vulnerability.

Those apps worked. The problem was row level security (RLS), the rules inside a database that decide which rows each visitor may see or change.

To be fair to Lovable, it now runs an automatic security scan before you publish that checks for gaps in these rules. Its own security documentation says the tools can't guarantee complete security and recommends an extra professional review for apps that handle sensitive data.

• Use proven services for logins and payments instead of letting the AI invent its own.
• Keep secret keys out of browser code. An API key is a password that lets software use a paid service, so store it in your host's environment variables.
• Make the AI attack its own app with the prompt below, then fix what it finds.
• Get a human review for anything in the bottom two rows of the table.

Audit this project for security problems before launch. Check:
1. Every database table: can a logged-out visitor read, add or change rows?
2. Any API keys or passwords visible in browser code or committed files.
3. Forms: what happens with very long, empty or malicious input?
4. Pages or endpoints that work without logging in but shouldn't.
Explain each finding in plain English, rank them by severity, and
don't change any code until I approve the fixes.

Risk 2: the AI does something destructive

In July 2025, SaaStr founder Jason Lemkin reported that Replit's AI agent deleted his production database, the live data his project depended on, despite instructions not to change anything without permission, as The Register reported. The agent had access to live data, and nothing technical stopped it.

• Separate test and live data. Build against a copy, and connect the real database only at launch.
• Keep version history you control. Commit to Git after every working step. Claude Code's checkpoints can rewind its own file edits, but they don't capture changes made by the commands it runs.
• Choose a mode that asks first. Recent terminal and VS Code versions of Claude Code start in Auto mode, where a background classifier approves actions for you. For sensitive work, press Shift+Tab or use the desktop mode selector to switch to Manual, which asks before editing files or running commands.

Risk 3: costs that creep up

Most vibe coding tools charge by usage, so the meter runs while you iterate. The expensive moment is the debug loop: the AI fails to fix a bug, you ask again, and every attempt costs.

• Plan before you build. A clear plan means fewer expensive rebuilds.
• Stop after two failed fixes. Use the prompt below instead of asking a third time.
• Set budget alerts on your AI tool and your host, and turn on a hard cap where one exists.
• Know your plan's limits. See Claude Code usage limits and Claude Code pricing.

Stop changing code. Explain in plain English what you think is causing
this problem, what you've tried so far, and why it didn't work. Then
give me two different ways to fix it, with the risks of each, and wait
for me to choose.

Risk 4: code nobody can maintain

Software needs upkeep. In December 2025, the React team disclosed a critical flaw in React Server Components, rated 10.0 out of 10 for severity, that let attackers run code on affected servers.

Apps built on frameworks such as Next.js had to upgrade immediately, and the React team warned against relying on hosting providers' protections instead. A vibe-coded app with nobody watching for advisories like that one simply stays exposed.

• Choose the simplest stack. Apps without a server weren't affected by that flaw at all, so follow the plain HTML approach in build a website with AI whenever it fits.
• Write things down. Ask the AI for a README and a CLAUDE.md file that explain how the project works and how to change it.
• Book a monthly check. Ask your AI tool to look for outdated or vulnerable dependencies and update them one at a time.
• Avoid lock-in. Make sure you can export the code or sync it to GitHub.

Risk 5: privacy and legal gaps

Even a simple page creates obligations once it collects names, emails or phone numbers. Privacy laws where your customers live may require a privacy notice, consent for marketing and limits on how you use the data.

• Collect only what you need. A name and a phone number may be enough for a booking.
• Say what you collect. Publish a short privacy page that explains what the form gathers and where it goes.
• Check your tracking. Analytics and ad pixels may need a consent banner, depending on where your visitors are.
• Treat AI legal text as a draft. AI can draft a privacy policy or terms, but it can't take responsibility for them.

The fair case for vibe coding

For many small businesses, the alternative to a vibe-coded tool isn't a carefully engineered app. It's nothing, or a template site they dislike and can't change.

Vibe coding lets owners test ideas cheaply, build internal tools nobody would have funded, and hand developers a working prototype instead of a vague brief. Once you review and test what the AI builds, you're no longer purely vibe coding, as the vibe coding definition guide explains.

When I build for clients with AI, the tool is never what makes the result safe. The boring checks around it do, and that is what the checklist below is for.

The vibe coding safety checklist

Before you build

While you build

Before launch

After launch

What to do next

Find your current or planned project in the risk table and run the matching checklist sections before you publish anything. If it sits in the bottom two rows, budget for a developer review now rather than after launch.

To compare tools by their guardrails and pricing, see the best vibe coding tools. The Builders course includes lessons on security basics, accessibility and privacy for sites you build with AI.