It often skips the security and privacy basics, and every new feature makes it harder to maintain. AI vibe coding tools are helpful for proving your idea, but it takes experienced developers to build it properly for production.
* Full disclosure: we build apps for a living, and we use AI tools every day. But we’ve also seen a growing number of AI-built apps arrive on our desk needing to be rescued. Here is our simplified view.
Many clients now ask us this question in different ways. For example, “Why would I pay for development when I can vibe code it myself?” (“vibe coding” means describing an app to an AI tool in plain language and letting it write the code). It’s a fair question. These tools are genuinely impressive. Let’s break it down and have a look.
Where Vibe Coding Works Well
- Clickable prototypes for testing an idea with real users.
- Investor or client demos that use dummy data.
- Simple internal tools that don't hold personal or client data.
- Exploring an idea before scoping a proper build.
PROTOTYPE
Great for proving your idea
dummy data
- Clickable screens to test with users
- Dummy data for demos
- Built in days, not months
- No database access rules
- Keys left in the app’s code
Developer
handover
PRODUCTION
Built properly for real users
- Real customer data, protected
- Access rules and encryption
- Secret keys kept off the app
- Reviewed, documented code
- POPIA in mind from day one
A vibe-coded prototype is a great start. Production needs the basics built in.
Where It Goes Wrong: Security
Most of the problems so far haven’t come from clever hackers. They’ve come from missing basics that a non-developer wouldn’t know to ask for, such as access rules on the database, keeping secret keys out of the app’s code, and encryption.
BY THE NUMBERS
170 of 1,645
Lovable apps checked by one researcher let anyone read their data.
400+
exposed secrets found in a scan of 5,600 live vibe-coded apps.
45%
of the time, AI models chose the insecure option in testing.
Sources: Matt Palmer, CVE-2025-48757 (2025) · Escape.tech, State of Security of Vibe-Coded Apps (2025) · Veracode, GenAI Code Security Report (2025)
- Missing database rules leave data open. About 1 in 10 Lovable apps checked by one researcher let anyone read their data.
- Secret keys and personal data are left exposed. A scan of 5,600 live vibe-coded apps found 400+ exposed secrets and 175 cases of exposed personal information.
- The platforms themselves have flaws. A Base44 flaw let outsiders into private company apps until it was fixed.
- One setting can expose everything. A single switched-off database setting exposed 1.5 million API tokens on one vibe-coded social network.
- The AI can break things on its own. An AI agent deleted a live database because test and live data weren't kept apart.
- The code itself isn't always safe. AI models chose the insecure option 45% of the time in testing, and people using AI wrote less secure code while feeling more confident about it.
Where It Goes Wrong: Privacy And POPIA
Under POPIA section 19, the business that owns an app must take reasonable steps to protect the personal information it holds. Using an AI builder doesn’t hand that responsibility to the platform. In fact, when WIRED reported on thousands of exposed vibe-coded apps in May 2026, Lovable said configuration is “ultimately the creator’s responsibility”. So if your app leaks customer data, it’s your business that answers for it.
…ultimately the creator’s responsibility.
Lovable, responding to WIRED’s report on thousands of exposed vibe-coded apps (May 2026)
Where It Goes Wrong: Code That’s Hard To Maintain
Every time you ask the AI for a new feature, it tends to add more code on top of the existing code. Nobody goes back to tidy it up, review it or document it. Over time this becomes what developers call “spaghetti code”: it works, until you need to change it.
In our experience, that’s exactly the pattern the research shows. As AI use has grown, more code is being copied and pasted and far less is being cleaned up (GitClear). More AI use has also been linked to less stable software releases (Google’s DORA report). The result is what some are calling “the vibe coding hangover”: senior developers being brought in to untangle AI-built apps.
Messy code also tends to be slow, heavy code. It’s fine for a demo with ten users, but it struggles when you need it to handle real users and real growth.
Where It Goes Wrong: Custom Code, App Store Approval And IP Ownership
Security holes get the headlines. Three quieter problems show up just as often when a vibe-coded prototype has to become a real product.
Custom code hits a ceiling. Lovable, Base44, Replit and Bubble are great until you need a real permissions model, a second integration, or a feature the platform will not give you. Or the hosting and licensing bill starts growing faster than your usage. At that point the real question is what you actually own, and whether to move it onto a stack you control.
App Store approval is a different job. What you build on Lovable or a similar tool is usually a web app. The Apple App Store and Google Play expect a packaged, signed mobile app, a privacy policy that meets POPIA or GDPR, permissions that match what the app actually uses, and proper listing assets. Apple and Google also reject apps that do no more than a website could.
IP and what you actually own. Lovable syncs to GitHub, and Base44, Replit and FlutterFlow can export your code. Bubble is the hard case: there is no source export another team can run, so leaving means a rebuild, not a port. Even with an export, dependencies and licences can quietly limit how you sell or distribute the product.
When you hit one of these ceilings, start with a code audit. A senior developer reads the code and tells you, in writing, what is portable, what is welded to the platform, what App Store and security gaps exist, and gives you a costed plan to fix it or move it.
So What Should You Do?
Don’t panic. A vibe-coded prototype isn’t wasted. It’s a great way to test your idea and show people what you mean. When you’re ready to launch, we’d suggest:
- Treat the vibe-coded version as a prototype, and plan a proper developer handover before launch, not after a breach.
- Get the code reviewed by a developer, and run security scans before going live.
- Make sure every database table has access rules, and that secret keys are kept off the app itself.
- Keep test and live data separate, and keep backups you've actually tested.
- Map what personal information the app holds and how it meets POPIA.
Conclusion
Vibe coding is brilliant for proving an idea quickly. But a prototype isn’t a product. The moment your app holds real customer data, takes payments or needs to scale, it needs to be built properly, with secure foundations, clean code and POPIA in mind from day one. That’s what we do. If you’ve built something with AI and want to take it to production, talk to us and we’ll help you get it there safely.
