Vibe coding is not engineering: a blunt opinion from someone who loves AI
I will say it plainly: I am one of the biggest enthusiasts of AI coding tools, and my team uses them every day. Still, the wave they call vibe coding — “type what you want, accept whatever the model suggests, don’t read …
I will say it plainly: I am one of the biggest enthusiasts of AI coding tools, and my team uses them every day. Still, the wave they call vibe coding — “type what you want, accept whatever the model suggests, don’t read the code” — produces something that looks like software and does not behave like software.
The story that repeats every month
An excited founder arrives with a “complete” app built over a weekend. It works on their machine. Then we run Security Guard Scanner on it — the scanner we built to detect XSS, SQLi and CSRF automatically — and the result appears within minutes: API keys inside the code, string-concatenated queries, and no authorisation checks anywhere. The app was not built; it was generated.
The difference between “works” and “correct”
Code that works is the starting point. Correct code is code that works when someone is trying to break it.
On the CyberBattleGround platform we train security teams to break deliberately vulnerable applications. The irony: unreviewed generated apps have become our best training material, because they collect every classic mistake in one place, with total confidence.
So what does engineering mean?
- Understanding before accepting: if you cannot explain why this line is here, do not merge it.
- Tests as a contract: tests are not a formality; they are the only way to know the next change did not break the last one.
- Trust boundaries: every external input is hostile until proven otherwise — whether a human or a model wrote the code.
- Operability: logs, monitoring, a rollback plan. An app you cannot observe is an app you cannot trust.
The right use of speed
AI makes the prototype cheap. That is wonderful: test your idea in two days instead of two months. But the moment real money or real data enters, the “prototype” must become an engineering project: full review, security scan, tests, and a rewrite of whatever nobody understands.
A note to founders
Do not be ashamed that your prototype was vibe-coded; be ashamed only if you ship it to customers in that state. The same tool that wrote the code fast can — when constrained by rules and review — make it correct fast too. The difference is not the tool. The difference is who is holding it.
