> ## Content Index > Fetch the complete content index at: https://jonathancanales.com/llms.txt > Use this file to discover other available public pages before exploring further. # What is vibe coding, how to do it right and who it is for - URL: https://jonathancanales.com/en/what-is-vibe-coding-how-to-do-it-right-who-its-for/ - Published: 2026-10-03T21:47:09.000Z - Updated: 2026-10-19T01:02:32.000Z - Description: "Vibe coding" sounds like a TikTok trend, but it has a date and an author. In February 2025, Andrej Karpathy (OpenAI cofounder and former head of AI at Tesla) posted on X that he had found "a new kind of coding" where you fully give in to the vibes, accept whatever the AI… - Author: Jonathan Canales - Tags: Technology and tools, #en What is vibe coding, how to do it right and who it is for 0:00 /401 1× [![Listen on Spotify](https://jonathancanales.com/content/images/2026/10/image-ebade917.jpg)](https://open.spotify.com/show/1RbZ5C2DI8VFR4RA6paicv?ref=jonathancanales.com) [Read in Spanish →](https://jonathancanales.com/que-es-vibe-coding-como-hacerlo-bien-y-para-quien/) "Vibe coding" sounds like a TikTok trend, but it has a date and an author. In February 2025, Andrej Karpathy (OpenAI cofounder and former head of AI at Tesla) posted on X that he had found "a new kind of coding" where you fully give in to the vibes, accept whatever the AI proposes, and forget the code even exists. A month later it was everywhere, and the definition had already stretched to mean almost anything. Let's put it back in order. ## What it is (the original definition) Karpathy described it like this: he talks to the tool, asks for things like "decrease the padding on the sidebar by half," always hits "Accept All," no longer reads the diffs, and when an error appears he pastes it in and it usually gets fixed. His own verdict: not bad for throwaway weekend projects, and quite amusing. Note the context: a top-tier programmer, talking about projects with no consequences. Simon Willison, a well-known developer in the AI world, drew a clear line a few weeks later: vibe coding is building software with an LLM *without reviewing the code it writes*. He stressed that this is not the same as programming with AI help. If you use AI but read, test and understand what comes out, that is AI-assisted programming. It is a useful distinction, because the blurred version lumps together someone playing on a Saturday with someone building something that will touch money and customer data. Order matters too; these are the files that give the tool its context: [files for vibe coding: context and order](https://jonathancanales.com/en/files-for-vibe-coding-context-and-order/). ## Who it suits Honestly, it suits these cases: - **Prototypes and proofs of concept.** You want to see whether an idea makes sense before paying to build it properly. - **Small personal or internal tools.** A dashboard, a converter, an automation only you or your close team use, with no sensitive data. - **Learning.** Seeing how an application comes together, even if you throw it away. - **People with business judgment but no code.** They can say what they need and judge whether the result behaves. It does not suit (or only with professional review): systems that handle payments, personal or health data; anything your customers use and your reputation depends on; software that must grow and be maintained for years. There, "the AI made it and it worked on my screen" is not a quality plan. If the code or data cannot leave your machine, there is an option: [AI that codes on your own computer: local LLMs](https://jonathancanales.com/en/ai-that-codes-on-your-own-computer-local-llms/). ## Why reviewing matters ⚠️ This is not abstract fear. Veracode tested more than 100 language models on coding tasks and found that in 45% of samples the code introduced OWASP Top 10 vulnerabilities, and that newer, larger models did not improve noticeably on security. It is a report from a security vendor with its own methodology, so read it as a signal, not a verdict. But the signal is clear: code that runs is not necessarily code that is safe. ![Whiteboard-style drawing: from toy with pure vibe to business with review; more risk, more review](https://jonathancanales.com/content/images/2026/10/6-vc-doodle-what-en-g.png) ## The responsible way to do it My version, no dogma, for anyone who wants speed without losing sleep: 1. **Decide the risk level before you start.** Is it a toy or does it touch real data? That sets how much vibe and how much review. 2. **Write down what you want first.** One page with the goal, who it is for, and what it must not do. A short instructions file for the tool helps a lot (I cover those in another article). 3. **Build in small pieces.** Ask for one thing, watch it work, move on. "Build me the whole system" is a recipe for a tangle. 4. **Test like a clumsy user would.** Weird data, buttons in the wrong order, empty fields. Also ask the AI to write automated tests, and check that they run. 5. **Use version control.** Save every step that works so you can go back. It is the grown-up undo button. 6. **Protect secrets.** Keys and passwords never go in the code or in the documents the AI reads. 7. **Have someone who knows review it before it becomes real.** When a project goes from toy to business, bring in a technical person. That is not bureaucracy; it is cheap life insurance. When you do this, you are no longer doing vibe coding in Karpathy's sense. You are doing AI-assisted programming, and there is no shame in that: for serious work it is exactly what is recommended. ## Three myths worth dropping - **"You no longer need to know anything."** You need to know what you want and recognize when something is wrong. The AI writes fast; it does not know what matters to your business. - **"If it runs, it's fine."** Running is the floor, not the ceiling. It also has to be secure, not lose data, and be understandable by someone else. - **"It's only for young programmers."** The opposite: whoever already knows how to ask, test and doubt gracefully gets the most out of it. That describes a lot of experienced business people. ## A good request and a bad one Bad: "build me an app for my business." Better: "I need a page where my customers submit a quote request with name, email and a description; I get an email alert; it stores nothing else; and if a field is missing, it shows a clear message." The second version is not more technical. It is clearer, and clarity is half the craft. ## My take Vibe coding is a genuinely powerful tool for exploring ideas fast, and it lowered the barrier for business people to build things that used to need a team. That is good. The problem starts when it is sold as "you don't need to know anything anymore." Knowing what you want, testing that it works and recognizing when something is risky is still human work, and it is the work that carries the most value. Use it to explore, to learn and to prototype. For what matters, read it, test it and have someone review it. Vibes are excellent for a dinner party; for your customer database, verify. ## Sources and editorial note Karpathy's original X post (February 2025), quoted in full in [Simon Willison, "Not all AI-assisted programming is vibe coding"](https://simonwillison.net/2025/Mar/19/vibe-coding/?ref=jonathancanales.com) (March 19, 2025). Context: [MIT Technology Review](https://www.technologyreview.com/2025/04/16/1115135/what-is-vibe-coding-exactly/?ref=jonathancanales.com). Security: [Veracode, 2025 GenAI Code Security Report](https://www.veracode.com/blog/genai-code-security-report/?ref=jonathancanales.com) (figure reported by the vendor).