Building Apps by Describing Them

A few years ago, building a small internal tool meant learning to code or finding someone who could. Today a marketing manager can describe a lead tracker in plain English, an operations lead can build a dashboard for the warehouse, and a consultant can turn a spreadsheet process into a web app for clients, in an afternoon and without writing code by hand.

This way of working has a name, vibe coding, and it became common enough in 2025 for Collins to choose it as its word of the year. This guide explains what it is, what it is good for, how to approach it so the result actually works, and where the risks are.

What vibe coding means

The term comes from Andrej Karpathy, a former OpenAI researcher and former director of AI at Tesla, who described in early 2025 a way of programming in which you “fully give in to the vibes” and “forget that the code even exists”. You describe what you want, the AI writes the code, you try the result and describe what to change, and you repeat. Collins defines it more soberly as the “use of artificial intelligence prompted by natural language to assist with the writing of computer code” (The Register).

In practice the term now covers a range. At one end, people with no programming background build complete apps through conversation. At the other, experienced developers hand large parts of their work to AI coding agents and review the result. This guide is written for the first group, and for anyone in between.

What you can realistically build

Vibe coding is at its best for small, focused tools with a clear purpose and a limited number of users:

Internal tools, such as a request form with an approval step, a tracker for a team process, or a simple inventory list.

Prototypes, to test an idea with real users before anyone invests in a full build.

Dashboards that pull data from a spreadsheet or an API and present it clearly.

Personal utilities, such as calculators, converters and small automations.

Landing pages and simple websites with forms and basic logic.

It becomes harder, and riskier, as an app grows: many users, payments, sensitive personal data, complex permissions or integrations with critical systems. Those projects can still start with vibe coding, but they need someone who understands the code before they go live.

The tools

The tools fall into two groups. App builders such as Lovable, Bolt, Replit and v0 run in the browser and take you from a description to a working app with hosting included. They are the easiest starting point. Coding assistants such as Cursor and Claude Code work with code files directly and give more control, at the price of a steeper learning curve. The Tools People Actually Use to Build With AI compares the main options, and Two Ways to Code With AI, Compared Honestly looks at the two most popular coding assistants.

How to work so it actually works

The people who get good results from vibe coding tend to work in the same way.

Plan before you prompt. Write down what the app is for, who uses it, the main screens and the data it stores. Ten minutes of planning saves hours of undoing a design the AI guessed at.

Build in small steps. Ask for one feature at a time and test it before moving on. A request for the whole app in one go produces something that looks complete and breaks in ways that are hard to trace.

Keep a working version. Use the tool’s version history or a code repository, so you can return to the last version that worked when a change goes wrong.

Test like a user. Click every button, enter odd data, leave fields empty, try it on a phone. The AI will often report that a feature works when it has not been tried, so check each one yourself.

From Idea to Working App, Step by Step walks through this process from the first idea to a published app.

Security: the part people skip

The biggest risk with vibe-coded apps is that they work perfectly in a demo while leaving data open to anyone who knows where to look. The AI writes code that does what you asked, and you may not have asked it to keep other people’s data private.

A well-known example came in 2025, when a security researcher found that more than 170 apps built with Lovable had databases that could be read without logging in, exposing names, email addresses, payment details and API keys. The cause was missing access rules on the database, which the generated apps had not set up (Superblocks).

A few rules prevent most problems:

Never put secret keys in the part of the app that runs in the browser. Ask the tool where each key is stored.

Ask explicitly for access rules, so each user can see only their own data, and test them by logging in as two different users.

Be careful with personal and payment data. If an app will handle either, have someone with security experience review it before launch.

Ask the AI to review its own work for security problems, and treat the review as a starting point rather than a guarantee.

Learn it properly

The free Vibe Coding course on Train Your Skills covers what vibe coding is good for, planning, building in small steps, data and secrets, testing and publishing, in six short lessons with a test at the end of each. Start the course here or browse all the free courses.