Vibe Coding

In a vibe-coding workflow, the developer shifts from typing syntax to directing an agentic IDE or CLI tool (such as Claude Code, Cursor, Windsurf, or GitHub Copilot Agent) using conversational prompts, screenshots, and pasted error logs. The coding agent reads the repository, plans multi-file edits, installs packages, runs terminal commands, and launches a local dev server. When a layout breaks or a test fails, the builder pastes the stack trace or asks the agent to fix the behaviour until the application works.

To keep coding agents effective as a repository grows beyond a weekend prototype, experienced teams moving from pure 'vibe coding' to disciplined agentic engineering add structural guardrails to the repo itself: a concise `AGENTS.md` or `CLAUDE.md` file documenting architectural rules and commands, strict TypeScript compiler flags, automated linter hooks, and fast unit/Playwright test suites that give the coding agent deterministic feedback loops.

For example, a London product manager with no React background vibe-coded a working internal pricing-calculator web app in an afternoon to validate workflow requirements with sales teams before handing the validated spec to platform engineers.

Vibe coding has collapsed the cost of disposable software, internal admin tools, UI prototypes, and one-off data scripts to near zero. Product managers, designers, and domain experts can now validate ideas with working software rather than static slide decks, while senior engineers use agentic coding to scaffold boilerplate and migrations in minutes.

However, shipping unreviewed, purely vibe-coded software straight into production customer systems accumulates severe security and maintainability debt. Without human code review and architectural stewardship, agents routinely introduce duplicated logic, N+1 database queries, permissive CORS policies, missing authentication checks on API routes, or hallucinated package dependencies (slopsquatting). The golden rule for engineering teams is simple: vibe-code prototypes freely, but enforce strict human review, automated security scanning, and deterministic test suites on every commit that touches production.