Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I avoid them. Some look cool, and might even be useful… but is there something lurking in the code the developer doesn’t even know about? Will it get support? Was there any thought or care when it comes to security? How long before the developer moves on to their next vibe coded project… an hour?
The only pure vibe coded apps on my computer (that I’m aware of), are ones I made myself.
by al_borland - How do you know if it's vibe coded or not? 60% of any app is third party dependencies that some random guy across the globe maintains, and the developer never even checked how the code is written.
Also, why vibe coded apps are prone to have viruses, and non vibe coded apps are virus free and have perfect security?
If it's open source, you can check the code, vibe coded or not (I doubt the majority does).
If it's a commercial app, the developer(s) probably care more about making money than writing the "perfectly secure" app, vibe coded or not.
by fnoef - I'm hesitant to, but more because it seems that many vibe coded apps* that I've come across have a week's worth of commits and no activity for the past 2-3 weeks. I have trouble imagining somebody who one-shotted an app is going to support that app for any reasonable lifespan. And, to your point, not only am I concerned about longevity of the app, but security and data harvesting concerns are also there.
*"vibe coded apps" in this context are ones whose description is full of emojis, the repo is in somebody's recently created personal GitHub account, and where there are likely already other apps addressing the same or similar use cases.
by reureu - If it feels vibe coded, chances are that they haven't run it through sufficient QA or a mindful design approach yet.
Or they simply haven't developed the taste to understand why it feels off, and likely aren't domain experts either.
by muzani - No. I simply don't (apart from company mandated ones like Claude Code), or do it in isolated VMs.by fodkodrasz
- No. I see the risk of a vibe coder getting prompt-injected to be negligible compared to a programmer being malicious themselves, and I've been running closed source executables for decades.
In general, I find that new vibe coded (or at least AI-assisted) user-facing software tends to be good, actually. LLMs don't have a 9 to 5 job, and don't get burnt out or tired. Vibe coded software tends to have attention to detail that I don't see in human-written open source software because a human wouldn't bother.
I'm enjoying democratization of software. Maybe in a few years we will have a vibe-coded open source Windows replacement.
by Aozora7 - I agree with many others in the thread. It’s pretty much impossible to not install apps that have “vibe coded” aspects to them now, if not completely vibe coded. We see this with Amazon/AWS boasting that a large percent of their code is now AI generated.
I think with that in mind, scanning tools like Trivy become more useful.
I am building a tool (https://github.com/trypando/pando) to help people deploy vibe coded apps at companies more safely and easily, and share them securely.
This has been really well received, and I think it’s because YES there are risks with AI generated apps, but the risks don’t currently outweigh the productivity gains.
by bemeeker - Lindy's law applies here: https://en.wikipedia.org/wiki/Lindy_effect
I'm not going to install vibecoded Photoshop when gimp exists.