An app idea and no coding skill no longer rule each other out. Lovable, Replit Agent and Google AI Studio’s vibe-coding mode can build a web app from plain language; Claude Code, Codex and Cursor go further for people ready to use a terminal or editor. The danger is security: a 2025 Veracode report found flaws in 45% of code from more than 100 models.
- Key Point: 45% failed. Veracode tested over 100 models; 45% of samples introduced OWASP Top 10 vulnerabilities.
- Key Point: Critical CVE. CVE-2025-48757 covers weak database rules in Lovable sites through 15 April 2025; MITRE scored it 9.3 out of 10.
- Key Point: Slang, not a method. Merriam-Webster defines vibe coding as telling an AI what to build and accepting errors without understanding the code — not a way to ship products with customer data.
From an X post to the dictionary
Andrej Karpathy, OpenAI’s co-founder, posted the term on X on 2 February 2025:
There is a new kind of coding I call ‘vibe coding’, where you fully give in to the vibes, embrace the exponentials, and forget that the code even exists.
Merriam-Webster lists it under slang: writing code or making apps by telling an AI what you want and letting it execute, without needing to know how or why it works, often accepting a certain number of errors. That clause matters: it is a relaxed style, not a launch method for client data.
Two families, different assumptions
All six tools were active and documented on official sites as of October 2026. Lovable lets non-coders generate web apps with interface, backend, database and authentication, syncing code with GitHub, GitLab or Bitbucket. Replit Agent turns natural-language ideas into apps and says programming is unnecessary. Google AI Studio serves non-coders and developers, using Gemini models to assemble a described app, with a free quota and an option for your own key.
The second family expects you to inspect code and targets developers and advanced users. Claude Code from Anthropic reads projects, edits files and runs commands in a terminal, editor, desktop app and browser. Codex from OpenAI is a coding agent in the ChatGPT desktop app, terminal and editor extension. Cursor from Anysphere for developers calls itself a coding agent for understanding a project, planning, fixing bugs and reviewing changes. Google says the AI Studio vibe-coding mode presented on 26 October 2025 targets people who have never written code. Claude Code is in all paid Claude plans, not the free one. For a prototype or a tool without sensitive data, the builders save weeks; trouble starts when an unreviewed prototype becomes a product.
Security is not the default
Veracode tested over 100 models in Java, Python, C# and JavaScript, publishing on 30 July 2025. Java was riskiest at 72% failures; Python 38%, JavaScript 43%, C# 45%. Against cross-site scripting, a classic injection attack, the tools failed in 86% of cases. Newer models write code that works better, but security performance stayed flat. OWASP’s 2025 language-model threat list adds that assistants sometimes suggest insecure or nonexistent libraries. Attackers watch for invented package names and publish malicious packages under them; installing a suggestion unchecked can add a trojan or other malware.
CVE-2025-48757, in the NIST US database from 30 May 2025, describes insufficient database security in Lovable-generated sites through 15 April 2025, letting attackers without credentials read or write tables. MITRE rated it 9.3 out of 10, critical. Lovable disputes it, per the record, because each client is responsible for protecting app data. Its documentation offers a quick scan on publish and a deeper one, but says neither replaces a full security review and responsibility remains yours, especially with sensitive data. If you cannot program, you cannot know what to ask in that review.
Start with less risk
- Use no third-party data: no passwords, payments or health data.
- In Replit’s Plan mode, the agent proposes tasks before touching code or data.
- Codex defaults to no network access in an isolated environment usually limited to the project folder and asks approval to leave; do not widen permissions without reason.
Vibe coding is a gift to people with ideas and no engineering budget, and a hazard for users of everything shipped without review. Karpathy said to forget that the code exists; Veracode’s data says the code exists anyway, and close to half the time it arrives with a hole. The assistant writes the program, but whoever clicks publish owns what it does. As prototypes become production, that convenience-accountability gap remains unresolved.