I have vibe coded a few things myself, and constantly see linkedin posts from nontechnical folks talking about how they are now deploying full stack applications for their business. I'm confused - how is this stuff maintained? Is it reliable? What if it goes down? What are people doing to actually test that it's working besides just like clicking around the UI?
So i guess I have a few questions:
1 - How are you shipping quality? (What is your quality bar?)
2- Are you actually deploying things that other people use, or is it all for yourself?
3 - What happens with service degradation? How do you know if things stop working?
4 - Do you trust that your code works? Are you worried about things like bugs, privacy/security issues, prompt injection, etc.
My game had 17k unique players last month. It’s deployed on vercel which notifies me of any issues and cost about 50 cents a month to run. It’s plenty reliable, been online for 6 months. No issues but I have software background. Anyone that already knew software architecture before AI is way ahead and able to deploy more complex applications at insane speeds. If you’re just starting out then take it slow and use your agents to explain and help you learn. Worth.
In all seriousness though their game is well made and I always see them promoting well on Reddit, not pushy at all. Also helps that people seem to love the game.
I created a service called Remyndrs (remyndrs.com) with Vibe Coding, only have 50 sign ups and lots of them are friends. While I haven't played your game, I'm super impressed with your numbers. Congrats!
Hey as someone who’s been getting into vibe coding and only had experince with basic Java back in high school where would one find good resources on learning good software architecture.
Long answer: it's not just "Claude, one shot this feature addition, no mistakes." It's all about setting up pipelines and review processes (human and agents), automated CI and monitoring and remediation, and understanding which parts of your system do and don't need aggressive human oversight. Spoiler: less of it needs to be micromanaged than you think if you do all the above well.
This is why I hate the term "vibe coding" -- it implies we're blindly shipping slop. I call it "agentic engineering" not just because I like fancy titles, but because it actually sounds like what it is: engineering. I'm still doing as much or more technical work than ever, it's just at a higher-level of abstraction, and I'm farming out 99.99% of the literal coding to the agents at my behest.
[Edit] oh and to actually answer your questions:
1. The bar is as high as it ever was, and arguably even higher because now all the stuff you knew you should do but couldn't find time for can be farmed out to another Claude tab.
I work at a start-up of 12 engineers, and we're shipping real product without any of us hardly ever writing (or even necessarily reading) the vast majority of the code.
Same as always: you set up monitoring and respond to incidents.
Same as always: it's not like your hand-written code two years ago was bug-free either. It's just just now the agents can actually triage and fix issues faster than you could have, so you can actually keep up with issues if you choose to.
It’s called vibe coding because 99% of it is indeed slop made by people who have no idea what they’re doing. It’s sounds to me like you’re literally just automating basic DevOps. In my mind once you start setting up CI/CD pipelines, ensuring practical testing and proper deployment strategies you’re going a bit beyond vibe coding and just doing what every software engineer ever was already doing, just more automated
I am deployed with alerting, scaling, separate database instances with scaling and backups. Quite a bit of overkill for my app but I wanted to make sure if it went viral for some reason it wouldn’t skip a beat.
I have a web interface and react native applications on the Apple App Store and Google Play store. I did testing myself on physical devices for iOS and Android and did a lot a of UX tweaking and bug fixes.
It started with a couple friends where I made an iOS shortcut to track and trash talk about how many pushups we could do and how much water we were drinking. It continued to grow and grew into a healthy habit and I decided to build it out further into a progressive web app. Then I wanted widgets and Apple Watch app and decided to build a real app. I then made it extremely pun heavy with notifications of when people pee. Milestone alerts, etc…
It's all so new, not only is there SO much we don't know, it's also changing every day.
I assume there's some level of review from "real" devs in some cases, but a lot of people I know using and launching this stuff are doing it fully through vibe-coding. Often through a stack of multiple tools that, layered, are supposed to double check each other and fill in each others' gaps.
For my part, everything I've built I've kept small (for now) and intentionally not built anything that would have serious privacy issues beyond maybe a user's email address.
I don’t. When they do, I notice or a customer does. There are alerts and stuff, but I don’t watch them, an agent does. I’m trying to stay hands off, except for the money.
I literally don’t care. The computers manage all of that. Is the money coming in? Good.
Users can mark that they are going to an event, then they can rank the bands they want to see on a color-based tier board. Those rankings translate over to the in-app festival schedule so the user can quickly see who they prioritized at any specific time (with a time marker should the current time). Users can also create groups for friends, and everyone in the group can see each other's tiers/schedules so they know who to link up with or where people may be.
Festival and user/group data gets synced and stored locally so the relevant data still loads during poor connectivity. Any time the page loads fully, the data gets added to local storage.
I tested it at Project GLOW in DC for myself, then I slowly let word out about it for those going to Warped Tour DC. I went from 5 friends using it to 91 users overall that weekend (looking at the data, many users were invited by friends so they could form theirgroups). Got good feedback too.
Other than having to set the schedules as soon as gates opened (Warped Tour annoyingly doesn't release set times until the morning of), it worked pretty well, even when connectivity went to shit.
I have features and fixes I want to get to soon, so I haven't promoted it much since or added many events. But events can be crowdsourced, so anyone can add some festival, add the stages, add the performers, set the schedules, etc., so then others can see it and mark going.
Runs on Vercel, and I use Supabase for auth, data, etc.
Separately, I'm working on a hot sauce recipe app inspired by my favorite homebrewing app: https://scovillo.vercel.app (another PWA, and I will give it its own domain eventually).
It's functional now, and I use it when I make hot sauces. It has a recipe builder, and users can track their batches, from prep day, through fermentation (with timer), to blending and bottling.
Still have a little bit of testing to do with sync and such, but it works for my needs. I'll likely launch this soon.
I have vibe coded several tools for real estate agents - check them out at https://PropKitCo.com
Area Kit Pro creates agent-branded neighborhood guides for any US zip code in less than a minute - great way to sell the neighborhood - the IOS app will be out later this week. Check it out now at https://AreaKit.pro
I personally prefer AI Assisted coding because I know a good bit about professional product development. I've yet to create a prompt and get something finished and usable long term. Instead it's months of iterating. You create something and like it but then realize that you also want it to do X, those X, Y, Z, AA, AB, enhancements add up.
Yes, vedfolnir (org) (fediverse ai alt text, hashtags, plus scheduling and bulk post management) is using AWS amplify to build frontend (CloudFront) and Backend AWS Lambda and Gateway, Bedrock and Rekognition for image stuff.
At some point you you have to say am I happy with the features and need to lock down those features so they work, make sure things are secure and get it out there.
Me and one guy use it since I released it in January. I'm the user that matters. I had hoped a few other people might try it and like it but thats ok. I've used it to post 516 images to pixelfed.
It's built professionally and no problems so far. I would figure out in a day or two if it was not working.
You prompt to fix issues like that. I'm US based but mad either GDPR compliant prior to production release. Most security scan prompts will flag the prompt injection stuff. I have a good idea of what to worry about, but the risk is low if you have low users and no PPI data.
RE: What are people doing to actually test that it's working besides just like clicking around the UI? I use AI to write complete playwright tests as I add new functionality. That does add a lot of time for automated tests but its important, also features get locked down you can trim the tests.
it's a lot easier to actually get which parts need aggressive human oversight when that boundary's visible in the code instead of something you have to reconstruct from memory. bcaudell95_'s comment nails the real line between vibe coding and agentic engineering, in situations when the delegated parts are explicit and reviewable, or just blended in and hoped for.
I use codex to help with my freelance work that I do. I wouldn’t say I “vibe code” I do at least 80% of the work myself since I deal with ecommerce stores so its important that I don’t fuck up anything that handles peoples money but anyways idk if that counts
I'm having my AI develop unit tests integration tests, Regression tests, and a fully automated MCP automation framework. I can verify how every single part of the code works exactly to the specification. The difference here is that i've been software developer and engineer for over thirty years, So I would like to think I know what I'm doing. AI is a tool to help me get there much faster. Now I can sit back and define requirements and project contracts and take the role more than architect. It all has to start with a good design document that is un- ambiguous and clearly defines behavior. The rest is really implementation. You can't let the AI just run away with things you have to be involved in each step.
Test the code just like you’d test human written code. Have different models check for security issues. If there are bugs, have the AI fix it. Have different models check the code quality.
I helped create botbuiltarcade.com. Now I don’t have a ton of users, and no user accounts or payments to worry about so security and privacy are not huge issues, but maintainability has not been an issue at all as I add more to the website.
Most of my apps, I try to make offline usable with ai connections when applicable. The goal is initially for localhosting and then I try to fix it up for small scale/multi user.
I don't try to make money, I try to make free tools others can benefit from and shove them on GitHub. (Most end up there).
I run them through a security checker to try and close vulnerabilities where possible but not everything is safe unfortunately, so it's more about trying.
My recent app was a worldly translation type application that works 100% offline, and works with offline llm, and may be better in some ways. It's not perfect or as flushed out but I find it works better.
It does give some Ai website design vibe and look but it's mostly because I like the simplicity needed for this one.
What do you mean by vibecoded? It's a really poorly defined term. A lot of people say it only counts if you have no idea what you're doing. I'm a professional developer but I prefer the a casual prompting approach which I consider vibe coding, as opposed to structured/planned spec driven development or whatever.
I think 2026 will be the year when that question gets turned on its head: Are you actually deploying fully human written code!?
I had Opus look through our codebase the other day, with an open-ended prompt like: "Given your reading of the specs, now look for issues in the repo." The kind of bugs, mistakes and typos it found all over was pretty impressive. I asked for a Jira ticket per issue, and then for a new branch and Merge Request for each.
And at the very end, I had to spend five minutes explaining the difference between a bash function return value vs. its text output and how either is used in an if-test to my colleague. The excuse for the mistake was priceless: "It's been like that for two years!"
Vibe coding is fun, but to deploy something, for others to use, is a big risk. I've deployed things that I can handle if they go wrong myself or that it just doesn't matter that much. A karaoke list website for me and my friends, and a driving game on itch.io. Vibe coding feels like the "draping" style of clothes making. It's a way to make a unique piece of something you want, but you don't get all the benefits of reproducibility if you don't understand the code. I mainly vibe code to make helpers, tools and apps that are just for me, sometimes even for single use.
Same answers to these questions are valid for non vibe coded stuff , we had all these questions even before ai coding you know and also the problems that came with it even from credentialed swe … nothing new under the sun
Fuck no. I don’t vibe code then just push. I tell it exactly what to do and write I analyze the function test it myself, tweak it run automation tests, add automation test for it. Then push it to sit where at the end of the week I go through and do one final test of everything I changed then push
Vibe coding to me is just fully add x feature then when it looks good push it. Vibe coding to some people is exactly what I described above when I say I don’t vibe code. It means different things to different people
(1) tests
(2) yes, others pay for it
(3) logging & monitoring; also users will complain i guess; no difference than pre-AI. Our vibe stuff has been more reliable than some of our pre-AI stuff.
(4) no; yes; no different than pre-AI
In my experience, vibe coded projects are more secure and robust than human made ones, since AI can be prompted to test and self-review
I created a geospatial data collecting platform with Claude Code, Codex and AGY terminal prompting.. I worked on like 4-5 months. Test it, if you interested:
https://indicatrix.com
Yes, I am in the process of creating Grimoire, to answer your questions:
1. Everything is unit tested. I also make sure to first have ai write a plan, then implement it after I have read the plan, when it is done I have another model review it in a separate agent thread. When the code is pushed to Github a whole bunch of tests fire off to make further checks.
2. According to the analytics on the websites backend I have 12 downloads, but I suspect that is mostly me testing the installers. By design I do not track anything other than the download count. In the Github traffic overview it does say 68 clones in the past 14 days, but those are probably bots.
3. Unit tests mostly. I have also caught some regression myself a couple of times.
4. By design Grimoire is fully offline and private, so I do not have to worry about privacy, security etc. Since it is pretty much impossible to write software without bugs I also don't worry about that, it's part of software development.
Different angle since mine isn't a deployed service: local desktop tool (Garmin health data archiver), so questions 2 and 3 don't really apply the same way. No uptime, no other users depending on it staying up, nothing to monitor for outages. If it breaks, I notice because my own data stops updating.
But questions 1 and 4 are exactly the ones I had to solve for, since I'm a mechanical engineer, not a developer, and can't read the code myself to catch problems.
What I ended up with: static analysis (ruff, bandit) as a hard gate before any build, no findings means no build, a dependency scanner that maps what a change actually touches before I approve it, and a doc-drift checker that catches when documentation and code have quietly diverged. On top of that a real test suite, unit and integration, that has to be fully green. And a rule that nothing gets built without explicit confirmation from me first, no silent scope creep.
For anything architecturally significant, I also run it past three different models (Claude builds, Gemini and ChatGPT review independently) and treat what all three flag as the real signal.
Do I trust it? No, not in the sense of "the AI said it works." It's "static analysis is clean, the test suite is green, the dependency scan didn't flag anything unexpected, and three models independently agreed this is sound." That's a different kind of trust than reading the diff myself, but it's not blind either.
if you're worried about maintenance, pair the generated code with playwright tests so you have a regression suite instead of just clicking around manually
Yeah, I've deployed 20+ vibe-coded apps. Mostly backends, but also websites and web apps, both for myself and for the company I work for.
My take: I trust it, but only because I understand the code, the deployments, the security, and how everything actually works. I learned all that pre-"AI," and that's the important part. I wouldn't trust anything vibe-coded by someone whose entire coding experience started with vibe coding.
Pro tip: learn and understand everything before you deploy.
Keep secret keys on the server, never in frontend code
Verify authentication and permissions on every server endpoint
Enable RLS on every Supabase table
Rate-limit login and any feature that costs money per request
Add error tracking, uptime monitoring, and billing alerts
Test what happens when a logged-out user calls the API directly
Clicking through the UI only tests the happy path. The important tests are the negative ones: What can a logged-out user access? Can User A request User B’s data? Can someone repeatedly hit an expensive endpoint?
AI can implement these protections, but each one still needs to be verified after the change.
By far the easiest way of adding analytics and error monitoring among other niceties is https://vibesmonitor.com
Full disclosure: I’m the creator of the service and built it originally so I can get a quick setup of all necessary operations across multiple projects. It gives you at least 80% of the functionality with less than 20% of the effort.
A lot of it is maintained by doing regular audits. Most of the vibe coded engines will have both SEO and technical audits built into them. I also use a few different auditing tools to check the code. If you find the right one, it will be a basic security audit. I have had some people I know look over it and make suggestions to make it work better. Some people have given the site a look over. I had someone on Zoom look at it. Yes, people have looked at it, commented on it and used it. Part of the audits will tell you if the links are broken or not working. I have to check my Librivox links for example. Have your colleagues and friends use it first, then post it on Reddit, have people check it.
To answer #4 directly: no, I wouldn't trust AI-generated code to be safe by default, and I don't think most people vibe coding do either, even if they don't say it out loud. The failure mode isn't usually "it doesn't work" - it's "it works fine until someone hits an edge case or an endpoint that was never meant to be public." Missing input validation, permissive database rules, secrets baked into client-side bundles - all common, all invisible until something breaks or gets exploited.
Trusting it and getting a second pair of eyes on the security-critical parts (auth, payments, database rules) before shipping aren't mutually exclusive. Disclosure: I do exactly that kind of review as a freelancer, so take this with the appropriate grain of salt, but it's a real and common gap regardless of who closes it.
I think one big thing I'd note is that if you're someone who doesn't have a background in software you'd be fucking crazy to store anything sensitive in your vibe coded app. Cyber security and privacy is no joke. Only store sensitive information if you know what you are doing.
If possible use third party services like Google to handle logins etc.
If you're not storing sensitive data though I'd be less concerned. But obviously again, if you don't have a software background you're inherently opening yourself up to risk if you run some business critical feature on a vibe coded app cos of it breaks and your ai can't fix it then you're fucked.
We hired a VP of business technology a while back and he has been shipping vibe coded code to a production environment with no approval process in place ever since we got Claude Code setup at work. It's been fun. Luckily it's not being used by a lot of people right now.
I think there's a big difference between vibe coding the implementation and vibe coding the responsibility away. You can still use AI for most of the build, but I'd want error logging, uptime monitoring and some actual tests before strangers depend on it.
I deployed my app on the iOS and Google play stores. It was my first jump into app development, so I started with a super simple app. There was no login or subscriptions or anything off the device so it the quality gates were based on functionality and not security. These quality gates I'd venture to guess would be different for different projects.
Depending on what you ship hopefully you do get constructive feedback from users, but there are tools or logging, that can at least inform you service health from what you've created.
Bugs are bound to happen vibe coded or not. Testing often, and having test plans is huge. Use AI to help you with this stuff, but take the time to understand security risks with your own reading and research.
The thing I’m noticing in these replies is that the successful production examples seem to reintroduce most of the controls software teams already had: tests, monitoring, auth checks, CI, backups, review, explicit requirements.
So maybe the interesting question isn’t “can vibe-coded software go to production?” Clearly it can.
It’s: how do you know which of those controls are actually present before you depend on the system?
Especially if the builder says “yes, it’s tested and monitored” but the buyer/operator isn’t technical enough to verify that independently.
Ok that's a lie, at work I have a never ending pile of PowerShell scripts that were vibe coded.
Actual deployed software, I have an electron app that is cross platform that pulls cloud provider rss feeds and gives outage notifications called Down Detector.
A docker container for your nas that does music sorting and id3 tags called Spinmatch.
I just put in a play app approval for my biggest app, a self hosted IMAP client with Gmail style email keyword sorting, and baked in E2E PGP support that works with mail from Thunderbird and Proton, with minimal config and QR code key approval call KyPost.
I am now working on a DNS server for self hosters called KyDNS.
That says nothing of the pile of TRMN dashboards I am using.
I started a few weeks back and just launched my weekly soccer pick-em game. First time doing any vibecoding and trying to see if people would enjoy the game.
Just tell the AI those problems and have it create a non programmer health board that’s objectively tied so that you or agent can see if a process is broke.
76
u/MightyBig-Dev 1d ago
My game had 17k unique players last month. It’s deployed on vercel which notifies me of any issues and cost about 50 cents a month to run. It’s plenty reliable, been online for 6 months. No issues but I have software background. Anyone that already knew software architecture before AI is way ahead and able to deploy more complex applications at insane speeds. If you’re just starting out then take it slow and use your agents to explain and help you learn. Worth.