Short answer: Vibe coding is building software by describing what you want to an AI model, running what it produces, and steering with follow-up prompts instead of reading every line of code. The term was coined by Andrej Karpathy in February 2025, and it now covers everything from weekend prototypes to apps that real people pay for.
Where the term came from
Andrej Karpathy, an OpenAI co-founder and former AI lead at Tesla, introduced "vibe coding" in an X post dated February 2, 2025. He described it as a way to "fully give in to the vibes, embrace exponentials, and forget that the code even exists."
The phrase spread fast. Merriam-Webster listed it as a "slang & trending" expression in March 2025, and Collins English Dictionary named "vibe coding" its 2025 Word of the Year, according to the Wikipedia entry that tracks the term.
A practical definition
For builders, a useful working definition has three parts:
- You describe intent in plain language. "Add a sign-up page with email login" instead of writing the form, the handler and the database call yourself.
- The model writes the code. Tools such as Lovable, Bolt, Replit, Cursor and Claude Code generate files, wire up a backend and often deploy the result.
- You judge by behavior, not by reading. You click through the app, see what breaks and prompt again.
Point 3 is what separates vibe coding from the broader category of AI-assisted programming. Simon Willison drew this line in his March 2025 post Not all AI-assisted programming is vibe coding: if you review, test and can explain the code the model wrote, you are doing ordinary software development with a faster typist. His rule of thumb is that he won't commit code he couldn't explain to someone else.
Vibe coding vs. AI-assisted programming
| Vibe coding | AI-assisted programming | |
|---|---|---|
| Who reads the code | Mostly nobody | The developer, line by line |
| How you judge it | Does the app do what I asked? | Does it work, and is it maintainable and correct? |
| Typical use | Prototypes, internal tools, side projects, MVPs | Production systems, team codebases |
| Main risk | Hidden problems you never looked for | Slower pace, review fatigue |
| Typical tools | Lovable, Bolt, Replit Agent, v0 | Cursor, Claude Code, Copilot in an IDE |
In practice most builders move along this line. You vibe code the first version, then start reading the parts that touch money, logins and user data.
Why it matters if you want to sell what you build
Vibe coding lowered the cost of making an app, and more people are shipping real products with it. In March 2025, 25% of Y Combinator's Winter 2025 startups had codebases that were 95% AI-generated, according to the same Wikipedia summary. It did not remove the work of making one that a stranger can trust with their data. Public research gives a sense of where the gaps tend to be:
- A December 2025 CodeRabbit analysis of 470 open-source pull requests found security vulnerabilities 2.74 times more often in AI co-authored code than in human-written code, as summarized on Wikipedia.
- In a July 2025 METR randomized trial, experienced open-source developers were 19% slower on 246 tasks when using AI tools, while believing they had been 20% faster (same source).
- Wiz Research found API keys and service credentials hardcoded into client-side JavaScript in vibe-coded apps, where anyone who opens the browser's developer tools can read them.
- GitGuardian counted 1,275,105 leaked secrets tied to AI services on public GitHub in 2025, up 81% from 2024, as reported by The Hacker News.
None of this means vibe-coded apps can't be sold. It means a buyer will ask questions the AI never asked you. Who can read the database? Where do the API keys live? What happens when the free tier of a service runs out?
What to check before you call a vibe-coded app "done"
A short list covers most of the common problems:
- Database access rules. If you use Supabase, row-level security has to be on and tested. See The Supabase RLS mistake.
- Secrets in the browser. Anything bundled into front-end code is public. Read Exposed API keys in front-end code for how to find and rotate them.
- HTTP security headers. A few lines of config close common gaps. See Security headers for vibe coders.
- Dependencies. Old packages with known vulnerabilities can slip in unnoticed when nobody reads the lockfile.
- Ownership. Can you hand over the domain, the repo and every third-party account cleanly?
You can run an automated pass over your app with the GreenGo checker. It is an automated scan, not a security audit.
Vibe coding and GreenGo
GreenGo Partners is a marketplace for apps, templates, AI agents and MCP servers built with AI tools, so vibe-coded projects are exactly what it was made for. Listing is free. On the Starter plan GreenGo takes 8% per sale, and buyers pay no extra marketplace fees.
Sellers can earn a Green Light badge by passing automated checks: DNS ownership, an MDN HTTP Observatory headers grade of B+ or better, Gitleaks secrets scanning, OSV-Scanner dependency checks (findings at CVSS 7.0 or higher fail) and delivery-file hygiene. The badge shows the check date and stays up for 90 days. It is not a security audit or certification, and it tells a buyer that a specific set of checks passed on a specific date.
If you have something ready, start at /sell.
Sources
- Vibe coding — Wikipedia
- Not all AI-assisted programming is vibe coding (but vibe coding rocks) — Simon Willison
- Common security risks in vibe-coded apps — Wiz Research
- The State of Secrets Sprawl 2026 — The Hacker News
Updated October 26, 2026.