Vibe Coding Explained: What It Means, Which Tools to Use, and How to Review AI-Written Code

What is vibe coding?

Vibe coding is a way of making software where you describe the app in natural language, an AI model writes the code, and you judge the result by running it. When something is wrong, you describe the problem back to the AI instead of fixing the code yourself.

AI researcher Andrej Karpathy used the phrase in February 2025 to describe building a throwaway project while almost forgetting the code exists. The term spread fast. Collins Dictionary named it Word of the Year for 2025 and defines it as the use of AI prompted by natural language to write computer code.

In practice people use “vibe coding” for a spectrum of work:

• Pure vibe coding: you never read the code. Fine for a personal tool, a demo or a weekend experiment.
• AI-assisted building: the AI writes most of the code, but you read the changes, run tests and understand the structure. This is what you need for anything other people will use.

The skill that matters in both is the same: explaining what you want precisely, and checking whether you got it. That is also why vibe coding sits naturally next to prompting and automation. If you have not yet read it, Agentic AI vs Generative AI explains why coding tools that edit files and run commands count as agents.

Which vibe coding tools should you use?

The tools fall into two groups. Browser app builders give you a chat box and a live preview, and handle hosting for you. Code editors and terminal agents work on a project folder on your computer and assume you will manage files, versions and deployment.

Tool	Type	Free option (checked September 2026)	Paid entry plan (checked September 2026)	Suits
Lovable	Browser app builder with hosting	Free plan with 5 build credits a day, up to 30 a month	See Lovable’s pricing page	Non-coders building web apps, landing pages and dashboards
Replit	Browser workspace with an AI agent, database and hosting	Free usage limits; see Replit’s page	Core: US$20 a month, or US$18 a month billed annually	Beginners who want an app, a database and deployment in one place
Cursor	AI code editor (desktop)	Hobby plan, no card, limited agent requests	Pro: US$20 a month	People who want to see and edit the code while the AI helps
Claude Code	Coding agent in the terminal, IDE, desktop app and web	Not included in Claude’s free plan	Included in Claude Pro: US$20 a month, or US$17 a month billed annually	People working on real repositories who want an agent that edits files and runs commands

Prices are in US dollars as listed on each vendor’s site, exclude taxes, and change often. Your bank will charge in rupees at its exchange rate. Credit-based tools can cost more than the headline price if you run many large requests, so watch the usage meter in your first month.

Other tools you will hear about include Bolt.new, v0 and Windsurf. They work on the same idea. Pick one browser builder and one editor-based tool; switching tools every week teaches you less than finishing a project.

How do you start vibe coding? A first project walkthrough

A good first project is small, useful to you, and easy to check. Here we build a flat expense splitter: three flatmates add shared bills, and the app tells them who owes whom. The walkthrough works in Lovable or Replit; the prompts are the same in Cursor or Claude Code.

Step 1: Write a one-paragraph spec before you open the tool

Most failed vibe coding sessions start with a vague prompt. Write down who uses the app, what they enter, what they see, and what “correct” means:

Build a simple web app for splitting flat expenses between 3 flatmates.
- Flatmates: Asha, Rahul, Meera (editable names).
- Add an expense: description, amount in rupees, who paid.
  Every expense is split equally between all 3.
- Show a list of expenses and a "Settle up" box that says
  who should pay whom, using the fewest payments.
- Show amounts as Indian rupees, e.g. ₹1,200.
- Save data in the browser so it survives a refresh.
- No login. Mobile-friendly. Keep the design plain.

Step 2: Paste the spec, then change one thing at a time

Paste the spec as your first message and let the tool build the first version. After that, ask for one change per message, such as “Add a delete button to each expense” or “Show each person’s total paid.” Small requests are easier for the AI to get right and easier for you to check.

Step 3: Test with numbers you have worked out yourself

Do not trust the app because it looks finished. Enter data where you already know the answer:

Expense	Amount	Paid by
Groceries	₹1,200	Asha
Electricity	₹900	Rahul
Internet	₹600	Meera

The total is ₹2,700, so each person’s share is ₹900. Asha paid ₹300 more than her share, Rahul paid exactly his share, and Meera paid ₹300 less. The correct “Settle up” result is a single line: Meera pays Asha ₹300. If the app shows anything else, describe the exact input and the wrong output to the AI and ask it to fix the calculation and explain what was wrong.

Then try the awkward cases: ₹1,000 split three ways (it does not divide evenly), a negative amount, an empty description, and refreshing the page. These are where AI-built apps usually slip.

Step 4: Save versions and deploy

Before each big change, save a version: browser builders keep a version history, and in Cursor or Claude Code you should commit to Git. When the AI breaks something, rolling back is faster than arguing with it. When the app works, use the tool’s publish or deploy button and share the link with your flatmates, not with the public.

Where does vibe coding break down?

Vibe coding is excellent at the first 80% of a small app. Problems grow with size, users and data:

• Security. In Veracode’s 2025 GenAI Code Security Report, which tested code from more than 100 language models across Java, Python, C# and JavaScript, 45% of code samples failed security tests and introduced OWASP Top 10 vulnerabilities. Models got better at writing working code, but not at writing secure code.
• Secrets in the wrong place. AI tools sometimes put API keys in front-end code, where anyone can read them in the browser.
• Login, payments and personal data. Authentication, access rules and payment flows look done long before they are safe. An app that stores phone numbers or Aadhaar details needs a proper review, not vibes.
• Growing codebases. As the project grows, the AI loses track of earlier decisions, duplicates code and fixes one bug by creating another. You notice this as a “fix loop”, where the same error keeps coming back.
• Databases. A careless migration can wipe data. Keep backups and never let an agent run destructive commands on live data without your approval.
• Cost surprises. Credit-based tools bill per request or per unit of work, and long fix loops burn credits quickly.

How do you review AI-written code?

You do not need to be a senior engineer to catch most problems. Use this checklist on every change before it reaches real users:

Check	What to do
Does it do the job?	Test with known inputs and expected outputs, like the ₹300 example above, including edge cases
Do you understand the change?	Ask the AI: “Explain this diff in plain English, file by file, and list anything risky.”
Where do secrets live?	Search the code for API keys and passwords; they belong in environment variables or the platform’s secrets store
Is user input trusted?	Anything a user types must be validated and never pasted directly into database queries or HTML
Who can see what?	Log in as two different test users and check that one cannot see the other’s data
Are there tests?	Ask the AI to write automated tests for the core logic and run them after every change
Second opinion	Ask a different model, or a fresh session, to review the code for security issues

Here is a real pattern to look for. Suppose the AI wrote this Python function for a small lead tracker that stores leads in SQLite:

import sqlite3

conn = sqlite3.connect(":memory:")
conn.execute("CREATE TABLE leads (name TEXT, city TEXT, phone TEXT)")
conn.executemany("INSERT INTO leads VALUES (?, ?, ?)", [
    ("Asha", "Pune", "98xxxxxx01"),
    ("Rahul", "Delhi", "98xxxxxx02"),
    ("Meera", "Pune", "98xxxxxx03"),
])

# What the AI wrote
def leads_by_city_unsafe(city):
    query = f"SELECT name FROM leads WHERE city = '{city}'"
    return [row[0] for row in conn.execute(query)]

print(leads_by_city_unsafe("Pune"))
print(leads_by_city_unsafe("x' OR '1'='1"))

Output:

['Asha', 'Meera']
['Asha', 'Rahul', 'Meera']

The first call works. The second shows the problem: because the city text is pasted straight into the SQL, a crafted input returns every lead in the table. This is SQL injection. The fix is a parameterised query, where the database treats the input as a value, never as code:

def leads_by_city(city):
    query = "SELECT name FROM leads WHERE city = ?"
    return [row[0] for row in conn.execute(query, (city,))]

print(leads_by_city("Pune"))
print(leads_by_city("x' OR '1'='1"))

Output:

['Asha', 'Meera']
[]

You do not need to spot this by eye every time. You need the habit of asking “what happens if a user types something strange?” and testing it.

Is vibe coding a useful career skill in India?

It is useful as part of a role, rarely as a job title on its own. Operations, marketing, product and founder roles increasingly expect people to build internal tools, dashboards and prototypes without waiting for an engineering team. Engineers use the same tools to move faster, with the review discipline above.

What hiring managers can judge is a working project with a short write-up: the problem, the tool, the prompts that mattered, how you tested it and what you would fix next. Our guide to AI projects for your resume shows how to present that, and the AI career roadmap for India maps where these skills fit. If you do not have a technical background, read AI courses for a non-technical background for realistic starting roles.

Frequently Asked Questions

What does vibe coding mean?

Vibe coding means building software by describing what you want to an AI tool in plain language and letting it write the code, then judging the result by running and testing it rather than writing the code yourself. Andrej Karpathy coined the term in February 2025.

Can I do vibe coding without knowing how to code?

Yes, for small personal tools, prototypes and simple web apps, using browser builders such as Lovable or Replit. For anything that handles real users, logins, payments or personal data, you need either basic coding knowledge or someone who can review the code for security and correctness.

Which is the best vibe coding tool for beginners?

There is no single best tool. Browser builders such as Lovable and Replit are the easiest start because they handle hosting. Cursor and Claude Code suit people who want to work with the code directly and manage versions with Git. Try one of each on the same small project.

Is vibe coding free?

Several tools have free tiers with limits. As checked in September 2026, Lovable gives 5 build credits a day up to 30 a month on its free plan, and Cursor has a free Hobby plan with limited agent requests. Heavier use needs a paid plan, typically around 20 US dollars a month.

Is AI-generated code safe to use?

Not automatically. Veracode reported in 2025 that 45 percent of AI-generated code samples it tested failed security tests. Test the code with known inputs, keep secrets out of front-end code, use parameterised database queries, and get a second review before real users rely on it.

Sources and methodology

• Collins Dictionary Language Blog, Collins Word of the Year 2025 (6 November 2025): vibe coding definition and Word of the Year. Checked September 2026.
• CNN Business, ‘Vibe coding’ named Collins Dictionary’s Word of the Year (6 November 2025): Karpathy coined the term in February 2025. Checked September 2026.
• Veracode, Insights from the 2025 GenAI Code Security Report (30 July 2025): 45% of samples failed security tests; 100+ models; four languages. Checked September 2026.
• Lovable, Pricing: free plan credits. Checked September 2026.
• Replit, Pricing: Core plan price. Checked September 2026.
• Cursor, Pricing: Hobby and Pro plans. Checked September 2026.
• Claude, Pricing and Claude Code overview: Pro price, Claude Code included in paid plans. Checked September 2026.

Method: tool facts and prices come from each vendor’s official page and are shown in the currency the vendor lists. The expense-splitter and lead-tracker examples were written by the ISS Editorial Team; the Python example was run on the sample data shown and produced the output shown.

Next steps

Pick the expense splitter or a tool you actually need, build it this week, and run the review checklist on it. If you want to go further with vibe coding, automations and RAG bots in a live cohort with project reviews, see the AI & Agentic Systems curriculum.

If it fits, you can apply for free. You speak with admissions first and pay only after you accept an offer.