Vibe coding for beginners
Free · 12 minutes · 6 interactive parts · Updated 3 November 2026
Vibe coding means building software by describing what you want to an AI tool, such as Lovable, Bolt, Cursor or Claude Code, and letting it write the code. You steer with plain language, run the result, check it and repeat. It is fast, but the AI won't warn you about security, costs or data loss, so you still need to understand what it built.
Part 1
What is vibe coding?
Vibe coding is building an app by describing it to an AI instead of writing the code yourself. You explain what you want, the AI writes it, you run it and check the result, then you ask for the next change. The term was coined by Andrej Karpathy in February 2025. The skill moves from typing code to steering and checking it.
Step 1 of 4
Describe
You say what you want, in plain words: one change at a time.
Common slip: Asking for five features at once. The AI guesses, and you can't tell which part broke.
- The loop is fast, so mistakes pile up fast. Check after every change, not at the end.
- Save a snapshot (a git commit) each time something works, so you can always go back.
Part 2
What parts does an app have?
Almost every web app has the same parts: the browser that shows pages, a server that runs your private logic, a database that stores data, a sign-in service that knows who is who, and hosting that puts it online. Payments, email and AI providers plug in from outside. Knowing which part a feature touches tells you where it can break.
holds everything inside this line
Browser
Shows pages and reacts to clicks. Its code is downloaded by every visitor.
- Who can see it
- Public: anyone can read it
- Words in your prompts that touch it
- page, button, form, 'use client'
- How it breaks
- The key in the bundle
- Anything in the browser is public. Secrets and rules belong on the server or in the database.
- When something fails, ask your AI which part it failed in. That halves the search.
Part 3
Which vibe coding tool should I use?
It depends on how much code you want to see. App builders like Lovable, Bolt, v0 and Replit build and host a whole app from a chat, with little code in sight. AI code editors like Cursor work on code in files you can read. Terminal agents like Claude Code make changes across a project from your command line. Many people start in an app builder and move on.
- No tool removes the need to check its work. Each one has its own security checklist on LogicTrail.
- You can switch later: most app builders let you export the code or sync it to GitHub.
Part 4
How do I write a good prompt for vibe coding?
A good build prompt says what to make, who uses it, what data it touches, what must not happen, and how you'll know it's done. 'Add a contact form' leaves the AI guessing. 'Add a contact form for visitors that saves name, email and message, rejects empty fields and shows a thank-you message' gets a feature you can check. Ask for one change at a time.
Your prompt
Add a contact form.
The AI still has to guess 5 things:
- who can use it
- what to store, and where
- what counts as invalid, and who can read it
- what finished looks like
- whether you want to approve the plan
- Ask the AI to explain its plan before it writes code. Plans are cheaper to fix than code.
- If it's going in circles, stop and ask it to explain the cause instead of trying another fix.
Part 5
How do I test an app I vibe coded?
Use the app the way a stranger would, not the way you built it. Sign in as a second account and try to open the first account's pages. Open it in a private window, signed out. Refresh in the middle of things, use it on a phone, and type wrong or empty input. AI-built apps usually work on the happy path and break on these.
- Test 1Sign in as a second account and open the first account's page by changing the number in the address bar.
- Test 2Open the app in a private window, signed out, and visit a page that should need sign-in.
- Test 3Click 'Pay' or 'Submit' twice, quickly.
- Test 4Refresh halfway through a form or right after signing in.
- Test 5Type nothing, a minus number, or a very long text into every field.
- Most data leaks are found by changing one number in the address bar while signed in as someone else.
- Ask your AI to write tests for what you just checked by hand, so it stays fixed.
Part 6
How do I launch a vibe coded app safely?
Before real users arrive, check five things: no secret keys in browser code, database rules (like Supabase Row Level Security) on every table, backups you have tested, spending limits on every paid service, and error alerts so you hear about problems first. Each takes minutes to check and prevents the most common disasters in AI-built apps.
Checkpoint 1
No secret keys in the browser
Secret keys in browser code can be copied by anyone and run up your bills.
Scan your site for keys- Run the free checks on LogicTrail: they look at your live site the way an attacker would.
- Set spending caps before launch day, not after the first surprise bill.
Questions
- Can I vibe code with no coding experience?
- Yes. App builders let you make working apps from plain language. You'll get further, and stay safer, if you learn to read code a little: where it runs, what a database query asks for and what an error means.
- Is vibe coding safe for real users?
- It can be, but AI tools often skip security that real apps need: database rules, secret keys kept on the server, permission checks. Check those before launch, or have someone review the app.
- How much does vibe coding cost?
- Most tools have a free tier and paid plans of roughly $20 to $50 a month. The surprise costs come later, from usage-based services such as AI APIs, databases and SMS, so set spending limits.
- Do I still need to learn to code?
- You don't need to write code, but reading it helps you steer the AI, spot mistakes and explain bugs precisely. The free 'Read what your AI wrote' course teaches exactly that.
Now see how apps break.
Walk a real incident in four minutes: a customer changes one number in the address bar and sees someone else's invoice. Free, no account needed.