What is vibe coding, and can you build a real app with it if you don't code?

What is vibe coding? Building software by describing what you want in plain language and letting an AI write the code, usually without reading it. AI researcher Andrej Karpathy coined the term on February 2, 2025, and Collins Dictionary named it its 2025 Word of the Year. Can someone who doesn't code build a real app with it? Yes. Tools like Lovable, Bolt, Replit and v0 turn a description into a working app with a database and sign-in, and put it live on the internet; Lovable's free plan gives 5 build credits a day. The part no tool does for you is making the app safe for strangers. Lovable's own docs say that's your responsibility, and the best-known vibe-coded failures came from people who never checked. All of this was read on the sources' own pages on November 3, 2026.

What does vibe coding mean, exactly?

It means you stop writing code and start describing results. Karpathy's original post on X, February 2, 2025, is the definition everyone quotes, and the rest of it is more useful than the famous first line:

In the same post he says "I 'Accept All' always, I don't read the diffs anymore" and "When I get error messages I just copy paste them in with no comment, usually that fixes it." That's the method in two sentences: ask, accept, paste the error back, repeat. He also wrote the line beginners should read twice: "It's not too bad for throwaway weekend projects, but still quite amusing."

Nine months later the term was a dictionary headline. Collins announced "vibe coding" as its Word of the Year 2025 on November 6, 2025, and described it as "the use of artificial intelligence prompted by natural language to write computer code. Basically, telling a machine what you want rather than painstakingly coding it yourself."

The spelling that won is two words, "vibe coding"; "vibecoding" as one word is used too. The other words that came with it, like agentic engineering, are in the vibe coding glossary.

Can someone who doesn't code build a real app with it?

Yes, and plenty of people already have. A "real app" here means something strangers can open in a browser: pages, a database that keeps what they enter, sign-in, and a public web address. The app builders do all of that from a description. Lovable's docs describe it as "a full-stack AI development platform for building, iterating on, and deploying web applications using natural language, with real code, security, and enterprise governance" (read Nov 3, 2026).

Here's what a first session looks like. You type: a page where customers leave a message and a star rating, saved so I can read them later. The builder writes the pages, creates a database table for the responses, shows a live preview, and asks nothing about code. You reply in plain English, "make it work on phones", "email me when someone submits", and it edits the app. Then you press Publish and it's on the internet.

The most public proof is also the most famous warning. Moltbook, a social network for AI agents that went viral in early 2026, was built this way. Wiz quotes its founder's post on X: "I didn’t write a single line of code for @moltbook. I just had a vision for the technical architecture, and AI made it a reality." It worked, it had real users, and it was live. Keep reading for what happened next.

What can you build, and what's harder?

Good fits for a first vibe-coded app, because the builders handle every part of them:

• Web apps with a few screens: booking forms, client portals, internal dashboards, directories, simple marketplaces.
• Tools for yourself or a small team: trackers, calculators, a CRM for one business.
• Prototypes to show people before you pay a developer.

Harder without some help:

• Phone apps in the App Store. The builders make web apps; getting into Apple's and Google's stores is a separate process with its own fees, covered in what it costs to get a vibe-coded app into the App Store.
• Apps that hold sensitive data or take money, because that's where the gaps below turn into real damage. Payments have their own guide: Stripe or Paddle in a Lovable app.
• Big apps that keep growing. After many rounds of changes the AI starts rewriting things that worked; a one-page plan helps, see spec first, then prompt.

Which tools do vibe coding, and is it free?

Two kinds. App builders write, host and publish the app for you: Lovable, Bolt, Replit and v0. Code tools work on code you keep on your own computer: Cursor and Claude Code. If you don't code, start with a builder; there's nothing to install.

You can start for free. Lovable's Plans and credits docs list the Free plan with 5 daily build credits, "up to 30 per month", and its subscription docs list Pro at $25 a month for 100 monthly credits ($250 a year), both read November 3, 2026. A credit is used each time the AI builds or changes something, so a free day is a handful of changes, enough to learn whether the idea works. Every tool's free plan and first paid plan, side by side, is in which vibe coding tool should I use.

What's the catch? The app works before it's safe

Go back to Karpathy's phrase: "forget that the code even exists." The code does exist. It runs on a server and holds real people's data the moment they use your app, and an app can work perfectly for you while its database is open to anyone.

That's what happened to Moltbook. On February 2, 2026, the security firm Wiz reported "a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data," and said the exposure included "1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents." Wiz says Moltbook secured it within hours of being told. The missing piece was one database setting, Row Level Security; the full story is in the Moltbook breach.

It isn't one app. Two more dated cases:

• Lovable, 2025. The US National Vulnerability Database lists CVE-2025-48757, published May 30, 2025: "An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites." The same entry notes Lovable disputes it, "because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application."
• Replit, July 2025. The Register's headline on July 21, 2025: "Vibe coding service Replit deleted user’s production database, faked data, told fibs galore", with the subtitle "AI ignored instruction to freeze code, forgot it could roll back errors, and generally made a terrible hash of things."

The builders now ship safety tools, and they're clear about their limits. Lovable's security docs (updated Nov 2, 2026) describe a built-in Quick scan and Deep scan, then say:

"You are responsible for ensuring that your app meets the security requirements appropriate for its use case, especially if it handles sensitive data or performs critical functions." So the honest answer to "can a non-coder build a real app?" is yes to building and yes to owning: the data, the keys and the bill are yours whether or not you read the code. The shortest safe version is the six checks before you share the link, with tool-specific versions for Lovable, Bolt and Replit. Everything else, from backups to uptime, is in shipping a vibe-coded app.

Is vibe coding dead? No, but the bar moved

You'll see headlines calling vibe coding passé and pushing a newer term, "agentic engineering". The difference comes down to one habit, whether you read the code the AI writes, and it's its own comparison. For someone who doesn't code, vibe coding is still exactly what these tools do. Professionals simply hold themselves to checking more, and even the creator of Rails has put his pencil down.

This page has no affiliate links or sponsored placements. Karpathy's words are quoted from the full text of his February 2, 2025 post; Collins, Lovable, Wiz, NIST and The Register are quoted word for word from their own pages, read November 3, 2026.