Key Takeaways
- Working is not the same as secure: Vibe coding tools produce functioning software fast, but without IT knowledge serious security gaps are easy to create.
- Bots attack everything: Automated attacks hit small solutions too, because stolen passwords are valuable when people reuse them.
- New models do not fix it: The big AI models are optimised mainly for more features, not for security.
- Developers remain essential, in a new role: Software architecture, the OWASP Top 10 and tools like Snyk still need human judgement.
- AI makes different mistakes: Like self-driving cars, AI makes fewer but different errors than people. Combining both works best.
- Prototype yes, production no: A quick prototype in Claude Code is a good start. It goes live only after a structured rebuild.
- Remember liability: If you sell software, managing directors can be personally liable, and NIS 2 brings reporting obligations.
Introduction
A week after I explained how to make vibe coding secure, I saw how urgent the topic is. At an event where my wife gave a keynote, a speaker proudly said he had replaced his expensive Microsoft Dynamics system with a solution he built himself in Claude Code. Then came the sentence that made me go quiet: he had no idea about software development, and he did not care, as long as it worked.
That misunderstanding is the subject of this article. Functionality is easy to achieve with today's vibe coding tools. The danger lies elsewhere. Whoever builds software without understanding software development will very likely ship serious security gaps without even noticing.
Why "It Works" Is a Dangerous Sentence
The tools really are good enough to build business software this way. The worrying part was the addition: no knowledge of software development, and that does not matter. This is where many people misread vibe coding. They hear: I type three prompts and get software. Often the functionality is indeed fine. What is missing is everything you cannot see: security, maintainability and a clean architecture.
Automated Bots Attack Every Application, Including Yours
Many people think their small tool is of no interest to attackers. That is a mistake. Automated bots probe software around the clock, regardless of size. They are not looking for your company. They are looking for open doors.
One common attack vector is harvesting passwords. Users often reuse the same password for online banking or company systems. Whoever steals the login data from a poorly secured home-made application therefore often holds the key to far more valuable accounts.
Why New AI Models Will Not Solve Security for You
A common objection is that models keep getting better, so security must be handled automatically by now. That is a fallacy. The large models are optimised mainly for new features, not necessarily for security, and that applies to practically every provider.
Some studies even show that an established predecessor model can be better suited to security tasks than the newest flagship. I mostly work with such a proven model anyway, because it uses far fewer tokens. Do not rely on the next model generation to do your security work.
Writing Code Is Fading, Software Architecture Is Not
It is often said that AI means nobody needs programmers anymore. I would phrase it differently. In future nobody will need people who write code by hand. But we need more than ever people who build a clean software architecture.
That includes knowing the OWASP Top 10, the list of the ten biggest security risks in software development. It includes knowing what Snyk is and connecting it to the GitHub repository before the first productive version goes live. Ignoring this is like driving without a seatbelt: most of the time nothing happens, but in software development I consider that attitude extremely dangerous.
The Middle Ground: What Services Like Lovable Offer
Between building everything yourself and a classic IT project there is a middle ground: services like the Swedish company Lovable. It keeps you away from the code if you wish, yet you can export it via GitHub, so there is no vendor lock-in. Lovable also offers a basic and a detailed security check.
What it supports only partly is a structured process like the BMAD framework, where requirements, UX design and architecture come before programming. And even with built-in checks, someone still has to judge the reported vulnerabilities. That takes expertise, which is why developers will not become redundant.
AI Makes Fewer Mistakes Than People, but Different Ones
We assume AI makes mistakes, and it does. We also assume humans work without errors, and they do not. Think of self-driving cars. No human would drive into a white truck the way a Tesla once did. But no Tesla would read a WhatsApp message while driving and rear-end the car in front. Overall, self-driving cars cause noticeably fewer accidents.
Because the errors differ, people spot the mistakes of AI and AI spots the mistakes of people. Someone with real database experience can judge whether Supabase, SQL or Dataverse is the right stack. Even after 44 years of programming, I ask a trusted computer scientist when I reach my limits, for example with Linux servers. Relying on prompts alone when you cannot judge the result is highly risky.
Prototype Yes, Production No
In projects I often tell business users to build a first prototype in Claude Code and hand it over. That is easy for them. But never put that prototype into production. Afterwards the solution is rebuilt properly, in my case often with the BMAD framework and its defined agent roles.
The prototype makes requirements visible. The user stories can be aligned with it, and refactoring works well: rebuilding and optimising the solution while removing redundancies in the code.
What Business Owners Should Consider Now
If you sell software, be very careful with vibe coding. Managing directors can be personally liable, and NIS 2 adds reporting obligations that no longer apply only to banks. Software you sell sits at the top of the risk scale.
If you want to close a small internal gap with a clearly defined scope, you do not need a huge IT project. But as soon as the solution is reachable from outside, you have an attack vector, and AI strengthens attackers too.
My rule remains: switch on your brain first, then the technology. AI helps on the safe side as well. It keeps documentation up to date, and in a current project it built and ran 497 test cases, including edge cases a human would hardly think of.
Mentioned Tools & Resources
- Claude Code: AI development tool by Anthropic, good for fast prototypes that should never go live unchecked.
- Lovable: Swedish vibe coding service with GitHub access and built-in security checks.
- BMAD framework: Structured development approach with defined agent roles for analysis, requirements, UX and architecture.
- OWASP Top 10: List of the ten biggest security risks in software development.
- Snyk: Security tool that finds vulnerabilities and belongs in the GitHub repository before go-live.
- NIS 2: EU cybersecurity directive with reporting obligations.
Frequently Asked Questions
What are the biggest risks of vibe coding?
Software that works but hides invisible security gaps. Without development knowledge you can judge neither the architecture nor reported vulnerabilities.
Why are small internal tools a target?
Automated bots attack every reachable application regardless of size. Stolen passwords are attractive, because many people reuse them.
Do new AI models make security reviews unnecessary?
No. The large models are optimised mainly for new features. Security checks, the OWASP Top 10 and tools like Snyk remain necessary.
Will we still need software developers?
Yes, with a different profile. Manual coding matters less, while architecture, security assessment and leading AI as an accelerator matter more.
Can a vibe coding prototype go into production?
No. A prototype makes requirements visible. Afterwards the solution should be rebuilt with architecture, security checks, tests and documentation.
What should managing directors keep in mind?
Selling software brings personal liability risks and NIS 2 duties. Anything reachable from outside is an attack vector.
Conclusion
Vibe coding is a great accelerator, but no substitute for expertise. The formula that works for me: AI to speed up writing code, a clear software architecture and solid business sense in the middle. Build prototypes yourself, but put nothing into production that has not been rebuilt, checked for security and documented.
