Vibe Coding Your Website: Where It Shines and Where It Bites

A year ago, the idea of building a business website over a weekend just by chatting to an AI would have sounded far-fetched. Today it's a normal Tuesday for a growing number of business owners, marketers and founders. They type what they want into tools like Lovable, Replit, Cursor and Claude, and watch working websites appear in minutes.

It's called vibe coding, and it's one of the most exciting and most misunderstood shifts in how websites get made.

The honest picture is more nuanced than the hype. Vibe coding is genuinely brilliant for some jobs and genuinely risky for others. Here's how the two sides stack up.

What vibe coding actually is

The term was coined by Andrej Karpathy in early 2025. The idea is simple. Instead of writing code line by line, you describe what you want in plain language and let the AI write it. You look at the result, ask for changes, and repeat.

The "vibe" part matters. In its purest form, vibe coding may involve accepting AI-generated code without thorough review of the output, instead relying on results and follow-up prompts to guide changes. You judge the website by how it looks and feels, not by what's happening under the bonnet.



That's where both its magic and its problems come from.

The case for vibe coding

It's astonishingly fast. What used to take a developer a week of back-and-forth can now be roughed out in an afternoon. For a campaign landing page, an event microsite or a quick product demo, that speed changes what's possible.



It closes the gap between the idea and the thing. Anyone who has written a web brief knows the pain of describing something in a document and getting back something slightly different. With vibe coding, the person who has the idea can shape it directly. You see it, you react, you refine.

It's brilliant for prototyping. Want to test whether a new offer lands before investing in a full build? Vibe code a rough version, put it in front of real people and learn fast. Throwaway versions are cheap, which means you can afford to be wrong a few times.

It lowers the barrier to entry. Small businesses that could never justify a custom build can now get something functional online. That's not nothing. The money behind these tools shows how seriously the market takes this: Lovable alone confirmed a new $13.3B valuation in August 2026.

It frees up skilled people. Used well by an experienced developer, AI handles the repetitive scaffolding so humans can focus on strategy, structure and the fiddly parts that actually need judgement.

The case against it

Security is the big one. AI tools are very good at making things work and much less good at making them safe. When Veracode tested over 100 models, they found that 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities, and that pass rate has not improved across multiple testing cycles from 2025 through early 2026.

This isn't theoretical. One study of Lovable-built sites found 170 out of 1,645 Lovable-created web applications having an issue that would allow personal information to be accessed by anyone. The cause was mundane: many websites did not correctly configure access controls for their database, which made their contents public. Researchers at Georgia Tech now track vulnerabilities traced directly to AI-written code, and the numbers are climbing, from 6 in January to 35 CVEs in a single month (March 2026).

For South African businesses, a leaky contact form or customer database isn't just embarrassing. It's a POPIA problem.

The AI sometimes invents things. Across 2.23 million AI-generated code samples, 19.7% contained at least one hallucinated package name that doesn't actually exist. Attackers have noticed, and now register those fake names to slip malicious code into projects. If nobody on your side can read the code, nobody will spot it.

The first 80% is easy. The last 20% is where it gets expensive. Vibe coding gets you to "looks done" remarkably quickly. But real websites need to handle edge cases, broken forms, odd browsers, slow connections, payment failures and a hundred things nobody thought to prompt for. That last stretch is where inexperienced builders stall, and where AI can start breaking one thing while fixing another.

Maintenance becomes a guessing game. A site you don't understand is a site you can't confidently change. Six months later, when a plugin needs updating or a feature needs adding, you're prompting in the dark and hoping nothing else snaps. Even seasoned operators have been caught out: in July 2025, SaaStr founder documented his negative experiences with vibe coding after an AI agent went badly off script with his project's database.

Search visibility can quietly suffer. Many vibe-coded sites are built as JavaScript-heavy apps that render content in the browser. They look great to humans but can be harder for search engines to read, and many AI crawlers struggle with them even more. If your site needs to rank on Google or be cited by ChatGPT, Perplexity and Google's AI answers, that's a serious consideration. Clean structure, proper metadata, schema and fast, crawlable pages don't happen by accident.



Ownership and lock-in. Some platforms make it easy to build and harder to leave. Before you commit, it's worth knowing where your code lives, who hosts it, and what it would take to move it.

So when does vibe coding make sense?

It's a strong fit when:

• You need a prototype or proof of concept to test an idea quickly
• It's a short-lived campaign or event page with no sensitive data
• It's an internal tool that only your team will use
• An experienced developer is steering it, reviewing the code and owning the outcome

It's a poor fit when:

• The site collects personal information, handles payments or logs people in
• It's your main business website and needs to perform in search for years
• Nobody involved can read, test or maintain the code
• Brand, accessibility and performance standards really matter



The bottom line

Vibe coding isn't a fad, and it isn't a replacement for expertise. It's a power tool. In skilled hands it makes good work faster. In unskilled hands it makes risky work faster.

The most sensible approach is a hybrid one: use AI for speed where speed matters, and bring in people who understand security, SEO and structure for anything that carries your brand, your data or your revenue. The question isn't whether AI can build your website. It's whether anyone will be responsible for what it builds.



If you're weighing up whether a vibe-coded site is right for your business, or you already have one and want a second pair of eyes on it, the VerdanTech team is happy to talk it through.