Everyone can build software now. That's why we start with safety.
In under a year, “vibe coding” went from a phrase on social media to Collins Dictionary's Word of the Year.[1] Indie builders, business owners, agencies and enterprise teams are all shipping software they didn't write by hand. Most of it works. A lot of it isn't safe yet. Here's what changed, what tends to go wrong, and why viberrr checks safety first and then puts growth at the centre.
About 8 minutes · Updated October 2026 · Every number sourced
It isn't just developers any more.
Software used to be built by people who write code for a living. Now it's built by anyone who can describe what they want.
Shipping more apps, faster, alone.
84% of developers use or plan to use AI tools, and 51% of professional developers use them every day.[3] At the largest software companies, leaders say AI now writes 20–30% (Microsoft) and “well over 30%” (Google) of their new code.[4]
A solo founder can now run a portfolio of apps. The review a team used to give each one doesn't scale with them.
Building the site themselves.
A studio, a gym, a consultant: they describe the site they want and an AI builder makes it, sign-ups, bookings and payments included. Nobody has counted this group reliably yet, but it's where much of the growth is.
There's often no developer in the loop at all, so nobody reads what the AI wrote before customers start using it.
Delivering in days, under someone else's name.
Client sites, internal tools and prototypes that took weeks now take days. The speed is real, and so is the new responsibility: every project carries the client's data and the agency's reputation.
A mistake that used to be caught in a long build cycle can now ship on day two.
Marketing, sales and product build their own tools.
Gartner expects enterprises to create 40% of new production software with vibe coding techniques and tools by 2028.[2] As one analyst put it, “the danger for organizations is that vibe coding could infiltrate and grow without their knowledge.”[2]
Tools built outside IT get connected to real customer data before anyone checks what they expose.
AI writes software that works. It doesn't make it safe by default.
This isn't a hunch. Researchers keep measuring it, in lab tests and in live apps.
- In live apps: an academic audit of 200 publicly deployed AI-built apps found at least one vulnerability in 91% of them, with 1,186 in total, about two-thirds rated critical or high. Most were broken access control, injection and sign-in failures. The researchers call insecurity “the norm rather than the exception.”[5]
- From AI coding agents: on 186 real-world feature tasks, 57% of one leading agent's solutions worked, but only 11.8% were secure. Adding security hints to the prompt didn't fix it.[6]
- From AI models: Georgetown researchers found that “almost half” of the code snippets five AI models produced contained bugs that could be exploited.[7]
- And the people using them feel safer: in a Stanford study, people with an AI assistant wrote less secure code, and were more likely to believe it was secure.[8]
The usual suspects
Keys in the front end
API keys and database keys pasted into code that ships to every visitor's browser. Anyone can read them, and use them.
Databases without access rules
One researcher found 170 of 1,645 apps from an AI builder's public showcase with missing database rules, exposing names, emails, addresses and payment details. It's now a recorded vulnerability, rated 9.3 out of 10.[9]
Sign-in that doesn't really lock
Pages and data that are “private” only because nobody linked to them.
Packages with known holes
Dependencies the AI pulled in that already have published vulnerabilities.
Going deeper: why scan · the threat model · launch checklist
What it looks like · February 2026
An AI-built social network left its whole database open: about 1.5 million API tokens, tens of thousands of email addresses and thousands of private conversations, readable and writable by anyone. Its founder had said he didn't write a single line of code.[10]
Growth multiplies whatever you shipped.
viberrr is a growth studio. We still start with safety, because everything we help you do next sends more people to your app.
More attention, more exposure
Every launch post, directory listing and answer that mentions you sends people, their data and plenty of bots to the app. A gap nobody noticed at ten users gets found at ten thousand.
Agents check before they act
People increasingly send AI agents to find, sign up for and use apps for them. Before an agent hands over someone's data or money, it looks for a reason to trust the app. More on agents →
Trust is what growth spends
Half of UK small businesses had a cyber breach or attack in the past year. Where the worst one had a real impact, it cost them about £7,960 on average, by their own count.[11] For a small app, the bigger cost is the trust you spent months earning.
Safety is step one, not the destination.
viberrr's framework is Ship → Listen → Create → Share → Measure. Ship is where we check your app is safe to put in front of people. Everything after it is growth: hearing what people say, making content in your voice, getting it out, and seeing what actually worked in your own numbers.
Step one
The main event: growth
The same gaps, different stakes.
If you're an indie builder
You're the developer, the security team and the marketer. A check before every launch stands in for the review you don't have, and keeps checking as you ship updates.
If you run a business
You didn't hire a developer, so nobody reviewed what the AI wrote. Your customers' bookings, emails and payments live behind it. You deserve to know it's locked, in plain words.
If you're an agency or consultancy
You ship under your client's name and your own reputation. The faster you deliver, the more a repeatable, evidence-backed check on every project matters, before handover and after.
If you're on an enterprise team
Tools built outside IT still touch real customer data. A quick, independent look at what each one exposes, before it spreads, is far cheaper than finding out later.
Check it in thirty seconds. Then get on with growing.
- Ship: SafeLaunch scans your site or app for leaked keys, open databases, vulnerable packages and what your live site gives away. Every finding comes with its evidence and a fix prompt for the AI you already use.
- Stay safe: vSafe keeps checking after launch, because apps change every time you ship.
- Then grow: Listen, Create, Share and Measure, with agents doing the legwork and you approving every step.
- An automated check, not a guarantee or a full security audit. We say so on every result.
Safety first, plainly.
Is vibe coding unsafe?
No. It's the fastest way most people will ever build software, and most of what it builds works. The issue is the defaults: AI writes code that runs, and it often leaves the doors a developer would have closed (keys in the front end, databases without access rules, weak sign-in). Those are fixable once you know they're there.
Doesn't my AI builder handle security for me?
Partly. Builders keep improving, and some now warn you about common mistakes. But your app is yours: the access rules on your database, the keys you pasted in, the packages your app pulled in. Researchers keep finding the same gaps in live apps, so an independent check on the live app is worth the 30 seconds.
I'm not technical. Can I fix what a scan finds?
Yes. viberrr explains each finding in plain words, shows the evidence, and gives you a fix prompt to paste into the AI builder or agent you already use. Then you re-scan to confirm it's closed.
Why not grow first and fix things later?
Because growth multiplies whatever you shipped. Every launch post sends more people, more data and more bots to the app, and agents acting for people increasingly check whether an app can be trusted before they use it. Fixing first is cheaper, and it means the attention you work for lands on something you're proud of.
Does a passing scan mean my app is secure?
No, and we'll never say it does. SafeLaunch is an automated check of the common, costly mistakes, with evidence for every finding. It isn't a guarantee or a full security audit. vSafe keeps checking after launch, because apps change.
Sources
- [1]"Vibe coding" named Collins Dictionary's Word of the Year · CNN Business (via KVIA), Nov 6, 2025
- [2]Gartner: by 2028, vibe coding tools will create 40% of new production software; Omdia on vibe coding growing unseen · CIO Dive, Jun 11, 2025
- [3]Developer Survey 2025: AI (49,000+ respondents) · Stack Overflow, Jul 2025
- [4]Microsoft and Google CEOs on how much of their code AI now writes · TechRepublic, Apr 2025
- [5]Understanding the (In)Security of Vibe-Coded Applications (preprint) · arXiv:2606.23130, Jun 2026
- [6]Is Vibe Coding Safe? Benchmarking AI coding agents on real-world tasks · arXiv:2512.03262 (ICML 2026), Sep 2026 (v4)
- [7]Cybersecurity Risks of AI-Generated Code · Georgetown CSET, Nov 2024
- [8]Do Users Write More Insecure Code with AI Assistants? (Stanford, ACM CCS 2023) · arXiv:2211.03622, 2023
- [9]CVE-2025-48757: missing row-level security in AI-generated apps (CVSS 9.3) · NIST National Vulnerability Database, May 2025
- [10]AI-built social network left its database open, exposing API tokens and private chats · SecurityBrief, Feb 5, 2026
- [11]Cyber Security Breaches Survey 2025 · UK Department for Science, Innovation and Technology, Apr 10, 2025
Studies marked preprint aren't peer-reviewed yet. Company figures on AI-written code are the companies' own statements. Incidents are described without naming the companies involved.
Start with thirty seconds.
Scan your site or app, fix what matters with the AI you already use, then get on with growing.