New AI software development: Take off fast. Land safely. Learn more

Security Check
Start for Free Book a Demo Contact
English|German
Platform Login
Guide

Vibe coding in business: opportunities, risks, checklist

Vibe coding means developing software by describing to an AI in natural language what you want and letting it write the code, often without reading the code yourself. It is fast and cheap. This guide by Evoya AI shows where the opportunities are, where self-built apps typically have gaps and how to find them.

Go to the checklist Request a Security Check
Definition

What is vibe coding?

Vibe coding means developing software by describing to an AI in natural language what you want and letting it write the code, often without reading the code yourself.

The typical workflow: you describe in a chat what the app should do, check the result in the browser and give feedback until it fits. The code itself is rarely read.

People who work this way are called vibe coders, often domain experts without training in software development.

There's a new kind of coding I call 'vibe coding', where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.

Andrej Karpathy, founding member of OpenAI and former head of AI at Tesla, coined the term on 2 February 2025 in a post on X.
Collins Dictionary chose «vibe coding» as its Word of the Year 2025.
Opportunities

Why vibe coding makes sense in business

Vibe coding is a real strength of AI. We use the same tools every day.

SpeedAn idea becomes a working app in days instead of months.
Domain experts build tooWhoever knows the process can map it themselves, without the detour of a requirements spec.
Low costA first prototype costs a fraction of a classic project.
Try instead of specifyYou try out what works in daily use and change it the same day.
Risks

What you see, and what you don’t

An app that works is not yet an app that is secure. The typical gaps lie below the surface, which is why they easily go unnoticed without developer knowledge.

What you see The interface looks good The functions work The problem is solved
What you don’t see
Missing access rulesThe database hands data to anyone who asks, because rules such as row level security are missing or too open.
Secrets in the frontendAPI keys or passwords sit in code that ends up in the browser, readable by everyone.
Login and rolesOften only the interface checks who may do what, not the server.
No backupsA mistake or an attack deletes data, and there is no earlier state to go back to.
No testsEvery change made via chat can break something else without anyone noticing.
Data protectionWhere is the data stored, which AI providers receive it, and does that comply with the Swiss FADP?
Not a theoretical risk: in 2025 a vulnerability in apps built with Lovable was published under the identifier CVE-2025-48757: because row level security rules in the database were missing or insufficient, unauthorised users could read and partly change tables. The cause was not an exotic flaw, but a missing basic setting that a developer checks routinely. And attackers use AI today as well to find such gaps faster.
Tools

The best-known vibe coding tools at a glance

The tools differ mainly in who they are made for: domain experts without programming skills, or developers.

ToolWhat it isMade for
LovableApp builder in the browser: create web apps via chat, with database and login for example through SupabaseDomain experts, founders, product teams
Bolt App builder in the browser by StackBlitzDomain experts, prototypes
Replit Online development environment with AI agent and hostingBeginners and developers
Cursor Code editor with built-in AIDevelopers
Claude CodeAI coding agent by Anthropic for the terminal and development environmentsDevelopers and technically minded teams

Evoya AI works with the tools your team uses and adapts to your stack. More about AI software development

Checklist

Security questions for self-built AI apps

Can you answer all twelve questions with yes? Then your app is in good shape. Every no is a point for the next step.

  1. Access rulesDoes every table in the database have rules for who may read and change which rows (e.g. row level security)?
  2. SecretsAre all API keys and passwords kept on the server and nowhere in code that runs in the browser?
  3. Permissions on the serverDoes the server check with every request whether the user is allowed to do this, not just the interface?
  4. LoginAre password reset, session length and, where needed, two-factor login set up properly?
  5. BackupsAre there automatic backups, and have you ever tested a restore?
  6. TestsDo automatic tests for the most important workflows run with every change?
  7. Security reviewIs every change checked for known vulnerabilities before it goes live?
  8. InputsAre inputs and file uploads validated before they reach the database?
  9. DependenciesAre the libraries you use updated regularly and checked for known vulnerabilities?
  10. MonitoringWould you notice if the app goes down or receives an unusual number of requests?
  11. Data protectionDo you know where your data is stored and which AI providers receive it, and does that comply with the FADP?
  12. Knowledge and handoverCould someone else keep running the app tomorrow, with documentation and access to the code?
Next step

When vibe coding is enough, and when professionals should step in

For a prototype or an internal experiment, vibe coding is often enough. As soon as an app carries responsibility in daily operations, an outside look pays off.

Vibe coding is enough

  • A prototype to show an idea
  • An internal experiment without real personal data
  • A short-lived analysis for your team

Bring in professionals as soon as …

Real personal dataThe app stores data of customers, employees or patients.
External usersThe app is reachable on the internet, not just for your team.
Business-criticalThe app accesses ERP, CRM or payments, or your operations depend on it.
Level 1 · You build

Guided Flight

Your team steers, we sit alongside.

Your teamEvoya AI
  • Training on your own project
  • Reviews of code and architecture
  • Guardrails for security and data
More about Guided Flight
Level 2 · Together

Ready for Takeoff

We lay the foundation, your team flies on.

Your teamEvoya AI
  • Database, login and backups
  • Your first AI Cockpit
  • Handover to your team
More about Ready for Takeoff
Level 3 · We buildFastest to the goal

AI Crew

We build with you, on site and at full speed.

Your teamEvoya AI
  • Developers with AI in your office
  • First version after a few days
  • Security review and handover
More about the AI Crew
Already built it yourself?Security CheckWe check your app for security, backups and architecture. View

How an AI Cockpit closes the gap between prototype and application: What is an AI Cockpit?

Frequently asked questions about vibe coding

Vibe coding means developing software by describing to an AI in natural language what you want and letting it write the code, often without reading the code yourself. It is fast and cheap.
The AI researcher Andrej Karpathy, a founding member of OpenAI, in a post on X on 2 February 2025. Collins Dictionary chose «vibe coding» as its Word of the Year 2025.
A vibe coder is someone who builds software with AI by describing it in natural language instead of programming it themselves. Often they are domain experts without training in software development.
Not automatically. The apps work and look good, but access rules, backups, tests and data protection are often missing without anyone noticing. With engineering knowledge this can be fixed: Evoya AI reviews such apps in the Security Check.
Well known are app builders such as Lovable, Bolt and Replit, aimed at domain experts, as well as tools for developers such as Cursor and Claude Code.
In principle yes, if data protection requirements are met: you need to know where the data is stored and which providers receive it, and protect the data technically. These are exactly the points we review in the Security Check.
The Security Check is deliberately designed as a small first step. The effort depends on the size of the app; after a short conversation you receive a clear quote.

Already built it yourself? Have it checked.

In the Security Check we review your app for security, backups and architecture and show you what needs to be done. Without slowing you down.

Request a Security Check Book an introduction call

Sources: Andrej Karpathy on X (2 Feb 2025) · Collins Word of the Year 2025 · NVD: CVE-2025-48757