What vibe coding is, and where it still goes wrong

Vibe coding is the practice of building software by describing what you want in natural language and accepting the AI-generated result, without reading or writing the underlying code yourself. It describes a workflow, not a technology. The products that support it end to end — generation, hosting, database, authentication — are usually called AI app builders or prompt-to-app platforms.

Does it actually work?

The generation part does. Neville Medhora, a twenty-year copywriter who runs an automated content business, puts the limit precisely: "People talk about vibe coding as if it just works, but it doesn't." His example is deploying — but that gap has largely closed since he said it. Every major platform now bundles hosting.

So what still goes wrong?

Security. A June 2026 scan by Symbiotic Security of 1,072 publicly deployed vibe-coded applications found 98% contained at least one vulnerability, most often exposed API keys or database layers left readable without authentication. The app works. What it exposes is the problem.

Should you use it?

For internal tools, prototypes and anything not holding customer data — yes, and the economics are hard to argue with. For anything handling real records, treat the generated data layer as unfinished until you have checked its access rules yourself.

The full breakdown, including which platforms do what, is in the guide to building an app without code.

Where this comes from

S2E1: AI should have killed his career. He's making $1M a year instead — the full interview with Neville Medhora. Listen or watch: YouTube, Spotify or Apple Podcasts.