## What is vibe coding?
Vibe coding is building software by describing what you want in plain language, after which AI writes the code. You type, for example: "make a page where customers can request an appointment, with name, phone number and a preferred date". The AI builds it, you look at the result and you adjust until it is right. You usually never read the code itself.
The term comes from Andrej Karpathy, co-founder of OpenAI and former director of AI at Tesla. On 2 February 2025 he described, in a post on X, a new way of programming in which you give in to the vibes and forget that the code even exists. He said himself that it suited throwaway weekend projects. Within a year the word was everywhere: Collins Dictionary named "vibe coding" its Word of the Year 2025 and defines it as the use of AI, prompted by natural language, to write computer code.
In the Exact SME Barometer (August 2026, research by Markteffect among more than 1,700 Dutch entrepreneurs), 70 percent say they use AI and 47 percent don't know how to use it effectively. Vibe coding is one way to turn that use into something tangible: software you use yourself tomorrow.
How does vibe coding work in practice?
You describe what you want, the AI builds a first version, you try it out and you give feedback in plain language: "make the button bigger", "email me when someone fills in the form". You work towards a result in rounds.
Broadly, there are two kinds of tools. App builders in the browser build and host everything for you. Lovable is a well-known example: you describe the app in a chat and Lovable creates the interface, the database, the login and the hosting. Then there are coding agents that work inside your own project. Claude Code from Anthropic reads your files, edits them and runs commands, in the terminal, in your code editor, in the desktop app or in the browser. If you are considering that route, first read what Claude Code is and how to get started.
What can you build yourself with AI as a business owner?
With vibe coding you build software yourself that is small, has a clear task and does little damage if something goes wrong. Four examples that are well within reach:
A landing page or simple website. A page for a new service, an event or your portfolio. Building a website with AI is the most accessible start: you see straight away what changes and a mistake is obvious immediately.
An internal form or tool. An intake form for your team, a calculator for quotes or an overview of open jobs. Only you and your colleagues use it, so you know who has access.
A simple automation. A script that turns a weekly export from your accounting software into an overview, or that puts incoming requests into a spreadsheet.
A prototype to test an idea. Building an app with AI is strongest for the first version. You let potential customers click through something before you spend money on a developer.
What these examples have in common: no money flows through them and they hold little or no personal data. If one stops working for a day, your business carries on as normal.
Where are the risks of vibe coding?
The risk sits in the part you can't see. The AI delivers something that works on your screen, and whether it is also secure is hard to judge without technical knowledge.
Security
In 2025 Veracode tested more than 100 language models on 80 coding tasks. In 45 percent of cases the generated code contained a security flaw, from the categories of the OWASP Top 10: the list of the most common risks for web applications.
A reported vulnerability in apps built with Lovable shows that this goes wrong in practice. According to the record CVE-2025-48757, insufficient database security (Row-Level Security) let attackers read or modify tables of generated sites without logging in. It concerns Lovable through 15 April 2025. Lovable disputes the report: according to the company, each customer is responsible for the data in their own app. For you, that means whoever publishes the app is responsible.
Customer data and the GDPR
If you store names, email addresses or other personal data, you are the data controller under the GDPR. If your app runs with a hosting company or database provider, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) requires a data processing agreement with that party. If data leaks, you report it to the authority within 72 hours, unless the breach is unlikely to pose a risk to the people involved. For more background, read AI and privacy for business owners.
Payments
Never let code you built yourself handle card details. Payment providers offer a hosted payment page that sends card details straight to the provider. Stripe explains in its integration security guide that such an integration reduces your obligations under PCI DSS, the security standard for card payments. Also have someone check how your app determines that a payment has actually arrived. An order that switches to "paid" without confirmation from the provider costs you money directly.
Maintenance
Software ages: components get security updates and connections with other software change. An app you don't understand is hard to repair when it breaks. Keep your code in version control and have the AI write down what each part does.
If you build in an AI feature that talks directly to customers, Article 50 of the AI Act also applies since 2 August 2026: people must know they are dealing with AI. The European Commission adopted guidelines on this transparency obligation on 20 July 2026 (as of November 2026).
Build it yourself or have it built: which risk needs what?
| Risk | Build it yourself with AI | Have it built or reviewed |
|---|---|---|
| Security | Static website, internal tool with no outside access | App with user accounts or a database reachable over the internet |
| Customer data (GDPR) | No storage of personal data, or a contact form that only sends an email | Storage of customer files, customer documents or health data |
| Payments | A link to your payment provider's hosted payment page | Your own checkout, subscriptions, refunds or automatically generated invoices |
| Maintenance | A tool you can do without for a week without harm | Software your revenue or customers depend on every day |
| AI feature | Internal use by your own team | An AI assistant that talks directly to customers (Article 50 AI Act) |
The rule of thumb: the more money, personal data or dependency, the sooner you bring in a professional. Often a review is enough: you build it yourself and a developer checks security and the database before it goes live.
How do you start safely with vibe coding?
1. Pick a first project from the "Build it yourself with AI" column. A landing page works well. 2. Describe in a few sentences beforehand what it needs to do. You give that text to the AI as its brief. 3. Use test data. Never put real customer data into a prototype. 4. Ask the AI to check its own work for security problems and to explain what it built. That catches the first mistakes. Anything from the "Have it built or reviewed" column still needs a review by a person.
Also write down which AI tools your team may use. Research by ABN AMRO and MWM2 among 777 Dutch organisations (June 2026) shows that 78 percent of SMEs use AI and 9 percent have a formal policy for external AI tools. Want to know where your business stands? Take the free AI readiness scan of 7 questions.
Frequently asked questions
What is vibe coding? Vibe coding is building software by describing what you want in plain language, after which AI writes the code. You test the result and adjust with new instructions. Andrej Karpathy introduced the term on 2 February 2025 and Collins Dictionary named it Word of the Year 2025.
Can I build a website with AI without coding skills? Yes. A landing page or simple website is the most achievable start, because you see straight away what changes. Before publishing, check the copy and where the data from your forms ends up.
Is building an app with AI safe? That depends on what the app does. In Veracode research from 2025, AI-generated code contained a security flaw in 45 percent of the test tasks. For internal tools without personal data that is manageable. With user accounts, customer data or payments, have the code reviewed before it goes live.
When should I have software built instead of vibe coding it myself? As soon as payments flow through it, you store customer data or your business depends on the software every day. Then you need security, GDPR arrangements and maintenance that are hard to arrange yourself without technical knowledge. Custom software from AI Agent starts from €1,950.
Which tools do you use for vibe coding? App builders in the browser, such as Lovable, handle interface, database and hosting for you. Coding agents, such as Claude Code from Anthropic, work inside your own project. App builders get you going faster, coding agents give you more control over your code.
Build it yourself, with someone looking over your shoulder
Want to build your own website with AI with someone at your side? In the Build a website with AI training you work one-on-one with Tarik Eraslan on your own site in a 3-hour session, followed by a week of digital support for your questions. The training costs €995 excl. VAT. You take it online, or on location in Amsterdam-Zuid for an additional fee agreed in advance.
If it concerns software with payments, customer data or integrations your business runs on, custom software is a better fit. It starts from €1,950 one-off.
