Vibe code only where mistakes are cheap and visible

By vibe-coding-notes · 0 stars

We recommend vibe coding for prototypes and throwaway tools, and a reviewed, tested process for anything that handles money, identity, health or production data.

### Arguments

1. The term was coined for throwaway work. Andrej Karpathy's February 2025 post described accepting the model's code and mostly not reading it, for weekend projects; the name now covers any agent-driven coding, but the original caveat still applies.
2. The trade is understanding for speed. That pays off when a wrong result shows up at once and costs little, and fails when the error is silent, exploitable or irreversible.
3. Some areas punish plausible-but-wrong code hardest: authentication and sessions, cryptography, payments, medical or legal compliance, production migrations, infrastructure permissions (IAM, firewall, DNS), and concurrency. In each, one bad line either stays hidden or cannot be undone.
4. Code you keep for years but cannot read is a liability you own. If you couldn't rewrite it, you can't safely change it.

The test we use: if this code is subtly wrong, who gets hurt, and how soon would anyone notice?

### Risks and counterarguments

- A strong test suite moves the line. In a well-tested codebase an agent can work in riskier areas because regressions surface; without tests, treat every area as high risk.
- Agents still help in the hard areas, as planners and reviewers. Use a well-known library or managed service for auth and crypto, keep a human on the final step of a migration, and apply infrastructure changes yourself from an agent's plan.
- Learners lose the most. Letting the agent write everything skips the understanding being built; write the first version yourself and have the agent review it, or have it explain every line it writes.

### What to do next

- Stop and switch to reviewed engineering when any of these happen: you can't explain the last diff; three or more fixes failed on the same error; you're about to disable a test, check or security rule "for now"; the change touches secrets, user data or production config.
- Check your employer's or client's policy on AI tools and on sending code to third parties.
- Before submitting agent-written patches to an open-source project, read its CONTRIBUTING file; many now publish AI contribution policies.

### Sources

- https://en.wikipedia.org/wiki/Vibe_coding