10 things to keep in mind when vibe coding a website

"Vibe coding" means describing what you want to an AI tool in plain language and letting it write the code. You check the result, ask for changes, and repeat. It's a genuinely useful way to build, and we use AI tools in our own work every day.

But AI writes code that looks right. It doesn't always write code that is right, and it rarely mentions the things it didn't do. Veracode's 2025 GenAI Code Security Report found that 45% of the AI-generated code samples it tested contained at least one common security flaw from the OWASP Top 10 list.

So before you share that link with customers, run through these ten things.

1. Decide what you're building before you prompt

When your instructions are vague, the AI fills the gaps with guesses. Write a short plan first: who the site is for, the pages it needs, what each page should do, and what a visitor should do next. Then build it one section at a time. You'll get a far more coherent result than from one giant "build me a website" prompt.

2. Keep secrets out of your code

API keys, database passwords and payment credentials should never sit in code that runs in the browser. Anything in front-end code can be read by anyone who opens their browser's developer tools. AI tools sometimes put keys right there because it's the quickest way to make something work.

• Keep secret keys on the server, stored as environment variables.
• Don't paste real production keys into AI prompts.
• If a key has ever been exposed, even briefly, replace it with a new one straight away.

3. Check who can see and change your data

This is the big one. AI-generated code often checks that a user is logged in, but not whether that user should be allowed to see a particular record. That's how one customer ends up able to view another customer's orders by changing a number in the address bar.

If you're using a hosted database like Supabase or Firebase, make sure access rules are switched on and actually restrict data. Row-level security in Supabase and security rules in Firebase exist for exactly this reason. Then test it: log in as one user and try to reach another user's data. If you can, so can anyone else.

4. Validate every form

Every form on your site is a door into it. Check inputs on the server, not just in the browser, since browser checks are easy to bypass. Add spam protection so your inbox doesn't fill with junk. If the site talks to a database, make sure it uses parameterised queries rather than stitching user input into database commands.

5. Check every package the AI adds

AI tools sometimes suggest software packages that don't exist. Attackers have started registering those made-up names and filling them with malicious code, waiting for someone to install them. Before you install anything the AI recommends, check that it's a real, well-known package that is actively maintained and widely used.

6. Don't assume Google can see your site

Many AI builders produce single-page apps that put the content together in the visitor's browser using JavaScript. That looks fine to you. But some search engines, and most WhatsApp, LinkedIn and Facebook link previews, may see a nearly blank page.

• Make sure each page has its own title and meta description in the HTML itself.
• Prefer setups that send ready-made HTML for each page, such as static pages or server rendering.
• Add a sitemap and check your pages using the URL Inspection tool in Google Search Console.

Our website launch checklist covers the rest of the SEO basics.

7. Test on real phones, for real people

AI-generated layouts often look great on a large screen and break on a small phone. Test on actual devices, including a budget Android phone. Check that text has enough contrast to read, images have alt text, and buttons are big enough to tap. Accessibility isn't only good practice. It's good for everyone who uses your site.

8. Watch the weight

Ask an AI to add an animation and it may pull in a whole animation library. Ask for an icon and you might get an entire icon set. Each request seems small, but together they slow the site down. Run your pages through PageSpeed Insights regularly. If you need help reading the results, see why websites are slow.

9. Save your work in small steps

AI tools are confident, and sometimes a fix for one thing quietly breaks three others. Use version control like Git, or at least your tool's checkpoint feature, and save a working version before every significant change. Make one change at a time and test it. When something breaks, you'll know exactly what caused it and can roll back in seconds.

10. Understand it before you launch it

If your name is on the website, you're responsible for what it does, including with your customers' data. You don't need to understand every line, but you should understand how it works. Ask the AI to explain each part in plain language. For anything that handles logins, payments or personal information, have an experienced developer review it before it goes live.

And don't forget the non-code basics: a privacy policy, contact details that work, analytics, and your own domain name.