TL;DR
- "Vibe coding" — prompting an AI and shipping whatever comes out — genuinely works for prototypes. It fails, often silently, when real users and real data show up.
- The failure modes are predictable: missing authorization checks, injection flaws, leaked secrets, logic bugs no one tested for, and a codebase nobody can safely change.
- The fix isn't less AI — it's the same AI plus engineering discipline: code review, tests, security checks, environments, and backups.
- Because engineers use AI too, that discipline no longer costs six figures. MadXR builds reviewed, tested custom web apps for $5,000–$15,000.
In 2026, anyone can describe an app to an AI tool and have something working by dinner. That is genuinely remarkable — and it is exactly the problem. The app looks finished. It demos beautifully. And nobody, including the person who "built" it, knows what the code actually does. This post is about the gap between software that runs and software you can trust.
What Vibe Coding Actually Is
The term describes a workflow: you tell an AI coding tool what you want, accept the code it generates without really reading it, paste the error messages back in when something breaks, and repeat until the app appears to work. No review, no tests, no architecture decisions — just vibes.
Let's be fair to the workflow: for a weekend prototype, an internal calculator, or a proof-of-concept to show investors, vibe coding is a superpower. The trouble starts when that prototype quietly becomes the production system — when it starts holding customer data, taking payments, or running a business process someone depends on. Prototypes get promoted; the discipline never gets added.
Where Vibe-Coded Apps Go Wrong
1. Security holes you can't see in a demo
AI models learned to code from public code — the good patterns and the bad ones. Unreviewed output routinely ships classic vulnerabilities: endpoints that check whether you're logged in but not whether you're allowed to see that record, user input concatenated into database queries, API keys hard-coded into files that end up in a public repository. None of these show up when the founder clicks through their own demo. All of them show up when someone hostile pokes at the app.
2. Silent logic bugs
A vibe-coded app is tested by one person trying the happy path. What happens when two users edit the same record? When a payment webhook arrives twice? When the date rolls over a timezone boundary? Engineered software answers these questions with tests written before launch. Vibe-coded software answers them in production, with real data, usually at the worst possible moment — and because nothing is monitored, the bug can run for weeks before anyone notices the numbers are wrong.
3. The eighty-percent wall
AI tools are phenomenal at the first 80% of an app and much weaker at the last 20% — the edge cases, integrations, and performance work that make software dependable. A non-engineer prompting in circles can't tell the difference between "almost done" and "structurally stuck." We regularly meet teams who spent three months prompt-looping on the last 20% of an app an engineer could have finished in two weeks.
4. A codebase nobody owns
Ask a simple question of a vibe-coded system: where are the backups? Which file handles login? What happens if we change this? If nobody can answer, every future change is a gamble. The code has no consistent structure because each prompt solved a local problem with no view of the whole. Eventually every fix breaks two other things, and the honest options narrow to "engineering rescue" or "rewrite." (We wrote separately about who maintains AI-built software — ownership is the question nobody asks until something breaks.)
Vibe-Coded vs Engineered: Side by Side
| Dimension | Vibe-Coded | Engineered (AI-Assisted) |
|---|---|---|
| Speed to demo | Hours — this is the seductive part | Days — AI does the typing here too |
| Code review | None; output is accepted on faith | Every change read and questioned by an engineer |
| Security | Unknown until someone hostile finds out | Auth, input handling, and secrets checked deliberately |
| Testing | One person clicking the happy path | Automated tests covering edge cases before launch |
| Data safety | Often no backups, one shared environment | Backups, staging environment, migrations you can undo |
| Changeability | Each fix risks breaking two other things | Structured code; changes stay local and predictable |
| True cost | Cheap up front, expensive when it fails | Known up front; falling every year thanks to AI |
"Engineered" here doesn't mean slow or artisanal — it means AI-accelerated work with review, tests, and operational basics attached.
The Fix Is Discipline, Not Less AI
Here's the part that gets lost in the vibe-coding debate: professional teams use the same AI tools. The difference is what wraps around them. At minimum, software that touches real users or real data should get:
- Human code review — an engineer reads what the AI wrote and asks why.
- Automated tests — for the paths that matter, written before users find the gaps.
- A security pass — authorization on every endpoint, input validation, secrets kept out of the code.
- Real environments — a staging copy to break safely, backups you have actually restored once.
- Monitoring — so the first report of a failure doesn't come from a customer.
None of this slows a modern team down much, because AI accelerates the disciplined work too — it drafts the tests, flags the suspicious patterns, writes the documentation. That's why the economics changed: at our published pricing, a reviewed, tested custom web app runs $5,000–$15,000 and an AI-powered build starts around $6,000 — figures that would have been $50,000-plus a few years ago. Speed and discipline stopped being a trade-off; you can now afford both.
When Vibe Coding Is Perfectly Fine
We're not purists. Vibe-code freely when the blast radius is small: throwaway prototypes, personal tools, internal scripts that touch no sensitive data, or an MVP experiment you fully intend to rebuild if it works. The line to watch is simple — the moment software holds someone else's data, moves money, or becomes something a team relies on daily, it has crossed into territory where "it seems to work" is not a safety standard.
And if you're already on the wrong side of that line — a vibe-coded app that grew into a real system — the news is mostly good. An engineering rescue (tests, security fixes, environments, documentation) is often a few weeks of work, not a rewrite. It's the same playbook we use when modernizing legacy systems, just applied to code that's six months old instead of sixteen years.
Frequently Asked Questions
What is vibe coding?
Vibe coding means describing what you want to an AI tool and accepting the code it produces without reading, reviewing, or testing it in any structured way. The term took off in 2025 as AI coding tools became good enough that non-engineers could produce working apps. The workflow is legitimate for prototypes and personal tools; the risk appears when unreviewed AI output is put in front of real users and real data.
Is AI-generated code less secure than human-written code?
Not inherently — the difference is review. AI models reproduce both good and bad patterns from their training data, so unreviewed AI code can ship classic vulnerabilities like missing authorization checks, injection flaws, and secrets committed to the repository. The same AI output, passed through code review, static analysis, and security testing, is as safe as any professionally built software. The process, not the author, determines the risk.
Can a vibe-coded app be rescued, or does it need a rewrite?
Many can be rescued. If the app's core logic is sound, an engineering pass — adding tests, fixing security holes, untangling the worst structural problems, and setting up proper environments and backups — is often cheaper than starting over. A rewrite makes more sense when the data model is wrong, when nobody can explain what the code does, or when every small change breaks something else.
How much does properly engineered custom software cost in 2026?
Less than it used to, because engineers now use AI too. At MadXR's published pricing, custom web applications run $5,000 to $15,000, mobile apps $20,000 to $30,000, and AI-powered builds start around $6,000. Those prices include the discipline vibe coding skips: code review, testing, security checks, proper environments, and 30 days of post-launch support.