Is vibe coding bad? An honest answer

No, but unguarded vibe coding is, and most criticism of vibe coding is really criticism of shipping unreviewed AI output to real users. That distinction matters, because one is fixable and the other would be a reason to quit. Here are the four real criticisms, what's true about each, and what actually prevents them.

Criticism 1: “AI code is full of security holes”

Largely true. AI agents optimize for “works in the demo,” not “survives contact with the internet.” The recurring offenders: secret keys pasted directly into code (where they end up public on GitHub), forms that trust whatever users type into them, and login checks that exist on the button but not on the server behind it. These aren't exotic bugs. They're the same three mistakes, over and over, in code that looks completely fine.

The fix is mechanical, which is good news: mechanical problems get caught by mechanical checks. Scan for secret-shaped strings before every commit. Review what changed before you ship, with security as an explicit question rather than a hope. How to check AI-generated code before you ship it is the full checklist.

Criticism 2: “It produces unmaintainable slop”

Half true. Left alone, an AI agent will happily write the same function four times in four places, bolt each new feature onto the side of the last one, and produce a project that works right up until you try to change it. That's the slop: not broken code, but structureless code that gets more expensive to touch every week.

But here's the half that's false: slop isn't a property of AI code. It's a property of never planning and never cleaning up: human teams produced slop for decades without any AI help. The prevention is the same as it's always been: decide what you're building before building it, keep changes focused, and periodically delete what's dead. The difference in 2026 is that the AI can run those habits itself when they're written down where it looks.

Criticism 3: “Vibe coders don't understand their own apps”

True, and it matters less than critics think, with one exception. You don't need to understand every line of your app any more than a restaurant owner needs to weld their own ovens. What you do need to understand is what your app does: what data it stores, who can see it, what happens when someone pays. Ignorance of syntax is fine. Ignorance of behavior is how you end up apologizing to your users.

The practical move: make the AI explain its work in your language, every time, and don't accept changes you can't restate in one sentence. “So this makes the login expire after 30 days, right?” If you can't produce that sentence, ask again before shipping.

Criticism 4: “It works until it suddenly doesn't”

True for a specific reason nobody tells beginners: AI agents have no memory. Every session starts from zero. The agent that builds your feature on Tuesday doesn't remember the decisions it made on Monday, so it happily contradicts them, and the app degrades in slow motion until something visible snaps. If you're already there, How to fix a vibe-coded app that's breaking is the recovery plan. The prevention is giving the agent a memory: project decisions written to files that every future session reads first.

So when is vibe coding actually the wrong choice?

• Life-critical or heavily regulated software: medical, aviation, banking infrastructure. Real engineers with real accountability, full stop.
• When you can't tolerate being wrong publicly. If a data leak would end your business, budget for a professional security review before launch: a few hundred dollars against an existential risk.
• When you refuse to do any checking at all. If your plan is to never review anything and ship whatever runs, the critics are right about you specifically.

FAQ